What we hold, and what we cannot reach

Helios connects to your MetaTrader 5 account at your broker. We are not a broker, we hold no client funds, we provide no custody, and we cannot withdraw from your trading account. Money never moves to us from your broker — the subscription and performance fee are billed to your payment method separately.

This is a meaningful reduction in what a compromise of us could cost you. It is not zero, which is what the rest of this page is about.

To trade your account, the system needs the MT5 login for it. Those credentials are protected with envelope encryption: each credential is encrypted under its own data key, and that data key is itself encrypted under a master key held separately from the database.

The practical consequence is that a stolen copy of the database is not a usable set of broker logins — the rows are ciphertext, and the key that unwraps them is not in there with them.

Each customer gets their own MetaTrader 5 terminal and their own gateway instance. Terminals are never shared. Every message crossing the boundary carries both a customer identifier and a broker identifier, which is what guarantees one customer's positions and orders cannot be attributed to another.

This is worth stating precisely, because it is the question people actually mean when they ask whether an AI trading system is safe:

These are architectural boundaries — separate processes with separate permissions — rather than instructions in a prompt. There is no wording that talks the agent past them, because the agent is never asked to respect them.

Sessions are signed, short-lived cookies. The browser never talks to the trading backend directly and never receives the backend API key: every request goes through a same-origin proxy that holds the credential server-side.

Responses carry a strict framing policy, so the console cannot be embedded in another page — a real concern for a surface with one-click controls that approve trades and pause live trading. Transport is HTTPS with HSTS.

Security pages tend to imply certifications nobody has. So, plainly:

• We hold no SOC 2, ISO 27001 or PCI attestation. None is claimed, and none is in progress that we would be entitled to advertise.
• We have not undergone an independent third-party penetration test that we can point you to.
• We do not claim your funds are insured, guaranteed or protected by us in any way. They are at your broker, subject to your broker's protections.

If any of those change, this page changes with them. Treat their absence as information rather than an oversight.

Email support@helios.trade with enough detail to reproduce the issue. Please report it to us before disclosing it publicly, and do not test against another customer's account or data — use your own. We will confirm receipt and tell you what we intend to do.

We do not currently run a paid bug bounty. We would still rather hear from you than not.

Privacy policy covers what data is held and why. Audit trail covers what is recorded about every decision.