AlgoRover security

Security model

AlgoRover Research is designed for research and historical validation. It does not connect to an exchange account, accept exchange credentials, place orders, or hold assets. AlgoRover Live adds local simulation and execution workflows, but trading credentials remain on your device and each live start requires your confirmation.

Local data and credentials

API keys, exchange credentials, imported datasets, backtest inputs, reports, charts, and runtime state are stored and processed locally. Do not paste credentials or other secrets into prompts, Marketplace requests, or support email.

Public services

AlgoRover public services use HTTPS, access controls, trusted-proxy validation, restricted application logging, and keyed hashing for ordinary public-request IP addresses. Approved strategy downloads are logged for delivery, quota enforcement, reliability, and abuse prevention as described in the Privacy Policy.

Packages and installation

Strategy packages contain executable Python code and may include third-party components. Install only from the official AlgoRover entry points, review the requested permissions and package source, and use a trusted, appropriately isolated environment. An AI host supporting a plugin does not mean every account, region, or host version exposes the same runtime permissions.

Controls you keep

You choose what to install, which data to use, when to run a backtest, and whether to start a simulation or live workflow. Keep operating systems and dependencies updated, protect local files and backups, use exchange-side permission limits where available, and stop a run if its behavior differs from your reviewed configuration.

Report a security issue

For a suspected vulnerability, privacy issue, unsafe package, or account concern, contact [email protected]. For formal legal notices, contact [email protected]. Do not include credentials, API keys, private datasets, or other secrets in email.

[email protected]