Stored encrypted
Rithmic passwords and ProjectX API keys are stored encrypted on the computer that runs Replica. They are not sent to our servers.
Security
How Replica protects your logins and accounts
This page explains where your broker logins are kept, how your orders reach your broker, what our servers store and how updates are checked. The checks that run on every copied trade are on the Account protection page.
Your broker logins
No password for Tradovate
Tradovate and NinjaTrader accounts sign in on Tradovate's own page, so Replica never sees or stores that password. To keep you signed in for up to 72 hours, our server keeps the Tradovate session encrypted and only renews it. It never places orders.
Each account sees only its own data
If more than one Replica account is used on the same computer, each one sees only its own connections, groups and rules.
Your orders
Sent straight to your broker
Replica sends orders directly to your broker's official connection. They never pass through a Replica server.
Closing always works
Closing, reducing and Flatten keep working in a running session, even if your subscription ends or our servers do not answer. Only new or larger copied positions are stopped.
Checks on every copy
Each fill is copied once, an order with an unclear result is never sent again, and Flatten confirms the account is flat. All of them are explained on the Account protection page.
Updates and support
Signed updates
Replica only installs updates that we have signed. An update that was changed or not signed by us is refused.
No passwords in logs
Passwords, keys and tokens are never written to logs or diagnostic reports. A diagnostic report is only sent when you choose to send one.
We never ask for your password
Support will never ask for your broker password or API key, on Discord or by email.
Your data
- Kept by the app on your computer: broker logins, copy groups, risk rules, positions, orders, the copier's records, the activity log and your Journal.
- Kept on our servers: your Replica account, subscription status, your profile and app preferences, the encrypted Tradovate session described above, and any diagnostic report you choose to send (deleted after 7 days). Payments are handled by Stripe; we never see your card number.
- The full detail is in the Privacy Policy.
Security questions
Account protection while copying: every safety check, explained. Your data: the Privacy Policy.
Does Replica see my broker password?
For Tradovate and NinjaTrader, no: you sign in on Tradovate's own page and Replica only receives the session Tradovate gives it. Rithmic passwords and ProjectX API keys are entered in the app and stored encrypted on the computer that runs it.
Do my orders go through a Replica server?
No. Replica sends every order straight to your broker.
What does the Replica server keep?
Your Replica account and subscription, your profile and app preferences, diagnostic reports you choose to send (deleted after 7 days), and, for Tradovate only, an encrypted session it renews so you do not have to sign in again for up to 72 hours. It never places orders.
Can someone push a fake update to Replica?
No. Replica only installs updates that we have signed. An update that was changed or not signed by us is refused.
What is in a diagnostic report?
The app's activity log and technical log, your connections' status, your copy groups and their settings, and recent orders and fills from your broker accounts, so support can see what happened. Passwords, keys and tokens are never included. A report is only sent when you choose to send one, and it is deleted after 7 days.