Enterprise Security & Non-Custodial Architecture
How ZeroTrade protects user identities, encrypts credentials, and secures multi-broker infrastructure.
Non-Custodial Design
ZeroTrade never holds user capital or requires withdrawal permissions. External broker connections only require trade execution and market data permissions.
AES-256-GCM Encryption
All external broker API keys, TOTP two-factor secrets, and OAuth credentials are encrypted at rest using AES-256-GCM with unique initialization vectors and authentication tags.
RFC 6238 Multi-Factor Auth
Native Time-Based One-Time Password (TOTP) support compatible with Google Authenticator, Microsoft Authenticator, and 1Password, plus 10 single-use SHA-256 hashed recovery codes.
Isolated Infrastructure
Containerized deployment with isolated Docker networks, dedicated database instances, strict CORS policies, and rate-limiting protections against brute-force attacks.