Skip to content
BookLog in

Security

How we protect your account

In plain language, and only what is actually in place today.

We never ask for your brokerage login. Not your password, API keys or account numbers - not on this website, not by email, not ever. A broker key goes only into your own bot, on its Settings > Brokers page. If anyone claiming to be BasisPoint asks, it isn't us.

What we never touch

  • This website never asks for, stores or sees your brokerage login, API keys or account numbers. A broker key goes only into your own bot, which keeps it encrypted.
  • We never hold your money or securities. Your bot places real orders only after you sign its agreement, only within the limits you set, and you can pause it at any time.
  • Use broker keys that can trade but not withdraw: the bot never needs to move money out of your account.
  • Our own trading bot can't reach this site's data: it can only send us one-way, signed updates in percentages, and nothing is ever sent back to it.

Signing in

  • Passwords are at least 12 characters and are checked against known data breaches (only a 5-character fragment of a scrambled version is sent to check). Our sign-in provider stores them hashed - nobody can read them.
  • Optional two-factor sign-in with an authenticator app. It's required for admin accounts.
  • Repeated wrong attempts are slowed down, then blocked for longer each time.
  • Error messages don't reveal whether an email address has an account.
  • “Keep me signed in” is your choice: 30 days while you use the site, otherwise you're signed out when the browser closes (and after 24 hours at most). Admin sessions end after 8 hours.
  • Changing your password, email or two-factor setting, downloading your data or deleting your account always asks you to confirm it's you first.

Your data

  • Stored with Supabase in the EU (Frankfurt).
  • Row-level security in the database itself: each account can only read and change its own data, and admin access requires a two-factor session. These rules are covered by tests.
  • We collect the minimum: your email, what you tell us about the tool you want, and security records. No advertising or tracking cookies.
  • You can download a copy of your data, or delete your account, yourself at any time.

The website

  • HTTPS only, enforced with HSTS.
  • A strict content security policy: the browser only runs this site's own scripts, each marked with a one-time code.
  • Other sites can't embed our pages or submit forms to them on your behalf.
  • Login cookies can't be read by page scripts and only travel over HTTPS.
  • Every form is checked again on the server, and user input is never inserted into pages as raw HTML.
  • Sign-ins, account changes, admin actions and data exports are recorded in a log that can't be edited.
  • Dependencies are checked for known vulnerabilities on every change, and updates are proposed automatically.

What we don't claim

We hold no security certifications, and this site hasn't yet had an independent security review. No system is perfectly secure - if we ever find a problem that affects your data, we'll tell you.

Found a problem?

Please email admin@basispointbot.com with the details. We read every report and will reply.