Security & Data Protection
We take security seriously. Here's exactly how we protect your data and what happens with your information.
Broker API Keys
The most common security question: "What happens to my broker API keys?"
Your API keys NEVER touch our servers
When you connect a broker, your API keys are stored only in your browser's local storage. They are sent directly from your browser to your broker's API when you place trades. Our servers are not involved in the transaction.
Stored Locally Only
Your broker API keys are stored in your browser's local storage. They never leave your device.
We Cannot See Them
Our servers never receive, process, or store your API keys. We literally cannot access them.
Direct to Broker
When you place a trade, your browser sends the request directly to your broker's API. We are not in the middle.
Easy to Remove
Clear your browser data or disconnect in settings to remove all stored keys instantly.
How Live Trading Works
Trade orders go directly from your browser to your broker. Nydar's servers only provide the UI and market data.
Platform Security Features
HTTPS Encryption
ActiveAll connections use TLS 1.3 encryption. Your data cannot be intercepted in transit.
Secure Password Storage
ActivePasswords are hashed using bcrypt with industry-standard salt rounds. We cannot see your password.
Content Security Policy
ActiveStrict CSP headers prevent XSS attacks and unauthorized script execution.
JWT Token Authentication
ActiveSecure, short-lived tokens for session management with automatic refresh.
What Data We Store
Data We Store
Account Data
- Email address
- Username
- Hashed password
- Email verification status
Preferences
- Dashboard layouts
- Watchlists
- Alert configurations
- Theme settings
Paper Trading
- Virtual positions
- Trade history
- Portfolio value
Data We NEVER Store
- Broker API keys or secrets
- Credit card or payment information
- Government ID or identity documents
- Your actual trading history (from brokers)
- Your broker account balance or holdings
- Precise geolocation data
Security Best Practices
Steps you can take to keep your accounts secure
Use Limited API Keys
When creating broker API keys, only enable permissions you need. Disable withdrawal permissions if available.
Use a Strong Password
Your Nydar password should be unique and at least 12 characters with mixed case, numbers, and symbols.
Keep Browser Updated
Modern browsers have security features that protect local storage. Keep your browser up to date.
Be Careful on Shared Devices
If using a shared computer, always log out and clear browser data when finished.
Monitor Your Broker Account
Regularly check your broker for any unauthorized activity. Revoke API keys if you notice anything suspicious.
Found a Security Issue?
If you've discovered a security vulnerability, please report it responsibly. We take all reports seriously and will respond promptly.
security@nydar.co.uk