Security at Optimus

Your backtesting history is the record of how you trade, and it deserves to be protected like any other sensitive data. We keep our attack surface deliberately small: no passwords to steal, no card numbers to leak, encrypted transport everywhere, and data strictly scoped to the account that created it.

• Sign-in is delegated entirely to Google OAuth — we never see, handle, or store a password.
• Sessions are managed with secure, HTTP-only cookies that JavaScript cannot read.
• Sessions expire automatically and can be ended at any time by signing out.
• Because your Google account is the key to your workspace, we strongly recommend enabling two-factor authentication on it.

All traffic between your browser and our servers is encrypted with TLS (HTTPS). Application data is stored in a managed database with encryption at rest, and internal service-to-service traffic runs on a private network that is not exposed to the public internet.

Every session, trade, and journal entry is bound to the account that created it, and every API request is authorized against that ownership before any data is returned. Other users can never read your backtesting data, and our own staff access production data only when required to operate the service or resolve an issue you raise.

• The platform runs on reputable managed cloud infrastructure with hardened, regularly patched images.
• Access to production systems follows the principle of least privilege and requires multi-factor authentication.
• Secrets and credentials are stored in dedicated secret managers, never in source code.
• Dependencies are monitored for known vulnerabilities and updated promptly.

Optimus is currently free and collects no payment details at all. If paid plans launch, payments will be processed by a PCI-DSS-compliant provider; card numbers will go directly to the processor and will never touch or be stored on our servers.

The database is backed up automatically on a regular schedule so your sessions and trade history can be restored in the event of a failure. We monitor the platform continuously and aim to communicate transparently about any incident that affects your data or availability.

• Protect the Google account you sign in with, and enable two-factor authentication on it.
• Sign out when using a shared or public computer.
• Be wary of anyone asking you to share your screen or account while "helping" with your trading.
• Report anything that looks wrong — unexpected sessions, trades you did not place, or suspicious emails claiming to be from Optimus.

If you believe you have found a security vulnerability in Optimus, we want to hear about it. Email security@optimus.trade with enough detail to reproduce the issue, and give us a reasonable window to fix it before public disclosure. We will acknowledge your report, keep you informed of progress, and credit you if you wish. Please do not access other users' data or degrade the service while testing.

Security questions or reports: security@optimus.trade. General questions: support@optimus.trade.