Security built for live trading automation
How TradeDupe authorizes brokerage access, protects your account, monitors execution health, and responds when something goes wrong.
Last updated October 14, 2026
Tradovate · Live
token enc.v1 · ••••••••••••
- AuthorizationTradovate OAuth
- Token storageAES-256-GCM
- Broker passwordNever stored
- WebsocketConnected
- Daily loss limitEnforced by broker
- Broker authorization
- OAuth
- Official Tradovate sign-in flow
- Broker passwords stored
- 0
- You sign in on Tradovate, not here
- Token encryption
- AES-256
- GCM, encrypted at rest
- Account protection
- 2FA
- Authenticator apps and passkeys
Account authorization
Your broker password never reaches us
TradeDupe connects to Tradovate through its official OAuth flow. You authenticate with the broker directly; we only ever hold a revocable access token.
- Account access uses Tradovate's official OAuth authorization flow.
- Users sign in directly with Tradovate; passwords are never sent to TradeDupe.
- TradeDupe receives a scoped access token, which can be revoked from Tradovate at any time.
- Access to production data is restricted to authorized operational workflows.
- 01
You start the connection
From your dashboard, choose Connect Tradovate. You are redirected to Tradovate's own sign-in page.
- 02
You sign in on Tradovate
Your username and password are entered on Tradovate's domain. They never pass through TradeDupe.
- 03
Tradovate issues a scoped token
After you approve access, Tradovate returns an access token to TradeDupe — not your credentials.
- 04
Token is encrypted and stored
The token is encrypted with AES-256-GCM before it is written to the database.
Defense in depth
Platform security
Layered controls protecting your TradeDupe account, your broker connection, and your billing details.
Encryption at rest
Broker access tokens are encrypted with AES-256-GCM before storage, using a dedicated server-side key.
Hashed passwords
TradeDupe account passwords are hashed with bcrypt. We never store or log them in plain text.
Two-factor & passkeys
Protect your account with an authenticator app or a hardware-backed passkey. Sensitive actions require step-up verification.
Abuse prevention
Bot protection on sign-up and sign-in, email verification, and monitoring for suspicious account activity.
Payments via Stripe
Card details are entered on Stripe and never touch TradeDupe servers. We only see billing status.
Risk limits at the broker
Daily loss and profit limits are written to Tradovate and enforced by the broker — not by TradeDupe.
What TradeDupe never does
- Ask for or store your Tradovate password
- Withdraw, transfer or move funds
- Store your card number
- Sell your personal information
Execution integrity
Reliability controls
Live markets don't wait. The copy engine is built to detect, recover from, and correct failures on its own.
Persistent health checks
Every connected account's websocket and session state is monitored continuously.
Automatic recovery
Reconnect and retry workflows recover from transient broker and network failures.
Rogue-trade protection
Follower fills the copy system didn't place are flattened to restore alignment with the leader.
Execution journal
Execution and recovery events are journaled for post-session auditability.
Methodology
How we measure performance
Clear definitions for the metrics we track, so the numbers mean exactly what they say.
- Copy latency
- Measured server-side from the moment a leader execution report is ingested to the moment follower orders are dispatched to the broker API.
- Copy success rate
- Successful follower placements divided by expected follower placements for enabled accounts. Disabled followers are excluded from the denominator.
- Uptime
- Availability of the copy worker infrastructure and its execution pathways. Degraded periods are captured in operational logs and reviewed for remediation.
When things go wrong
Incident response standards
- 01
Detect & triage
Severity-based response: service-impacting incidents are triaged immediately.
- 02
Communicate
Customers receive status communication when issues affect execution quality.
- 03
Investigate
Investigation documents scope, root cause, and remediation.
- 04
Prevent repeats
Post-incident improvements are prioritized to reduce repeat failure modes.
FAQ
Common security questions
Does TradeDupe ever see my Tradovate password?
No. You sign in on Tradovate's own page through their official OAuth flow. TradeDupe only receives an access token that Tradovate issues after you approve the connection.
How do I revoke TradeDupe's access?
Remove the connection from your TradeDupe dashboard, or revoke the authorization from your Tradovate account. Either way, the token stops working for copy trading.
Can TradeDupe withdraw or move money from my account?
No. TradeDupe places, modifies and cancels orders to mirror your leader account and reads positions and fills. It has no ability to withdraw or transfer funds.
What happens if the connection drops mid-session?
Account health is monitored continuously. Transient disconnects are recovered automatically, and fills that weren't placed by the copy system are flattened to keep followers aligned with the leader.
Who enforces my daily loss limit?
Tradovate does. Limits you set in TradeDupe are written to your broker account and enforced broker-side, so they keep working even if TradeDupe is unreachable.
Due-diligence questions or a security report?
Reach the team directly. Responsible disclosure reports are reviewed by a person.
See also our Privacy Policy and Terms of Service.