Security
Because this is a tool that handles real trading money, we designed account, data, and access security as the top priority. "Safe" on this page means the security of the software and your account — it does not guarantee trading outcomes or your capital.
Honest first — what we protect, and what we can’t
What Merini protects is your account, data, and access. We’ll be just as clear about what we can’t. We cannot prevent market losses — leveraged trading can lose more than your deposit. And Merini does not custody your funds. Deposits, withdrawals, and custody are handled by the broker you connect yourself; we are neutral software that provides charts, orders, and analysis on top of it. So instead of telling you to "rest assured," we simply show you what we protect and how, below.
How we protect it
Account security
Passwords are never stored in plaintext — only as a one-way hash (bcrypt). We support two-factor authentication via email OTP and authenticator apps (TOTP), with trusted-device management and forced logout to control sessions. Login tokens are handled in httpOnly cookies to block script-based theft.
Encryption in transit and at rest
All connections are protected by transport encryption (HTTPS/TLS). Sensitive credentials used for broker connections are stored encrypted, access is granted on a least-privilege basis, and access is recorded in audit logs.
Broker connections — we don’t hold your funds
Live trading happens on the broker account you connect yourself. A cTrader connection uses delegated tokens (OAuth), so we never store your broker login password. You can disconnect at any time, and stored credentials are discarded when you do. Deposits, withdrawals, and custody are entirely the broker’s responsibility.
Operations that stay up
To keep the service from going down mid-session, we run zero-downtime deploys and multiple health monitors, with regular backups and disaster-recovery procedures. It’s built so that we detect problems before you do.
Privacy
We use no advertising or tracking cookies, and we do not sell personal data. Collection is limited to what’s needed to run the service. The full list, retention, and your rights are in our Privacy Policy.
Honest data
We don’t fabricate data that doesn’t exist. Unreliable order-book quantities are left as "—" instead of fake numbers, and charts, prices, and P&L show real values only. On principle, we never dress up prices or P&L just to look good.
No conflict of interest
Merini does not solicit or broker trades with any particular broker, and earns nothing from broker referral fees. Our only revenue is subscriptions — so we have no structural reason to push any broker on you.
What we don’t do
- ✕ Store passwords in plaintext
- ✕ Sell your data or use ad tracking
- ✕ Fabricate quotes, fills, or P&L
- ✕ Earn from broker referrals or rebates
- ✕ Hold or manage your funds for you
- ✕ Promise "no losses" or "guaranteed returns"
Verify before you trust
Security isn’t a promise you take on faith — it’s something you check. The Merini demo opens with just an email, no install and no deposit. Try it yourself on real-time prices with virtual funds, see the screen, the orders, and the security, then decide.
Check it yourself on the demo※ No system can guarantee absolute security, and protecting your account (a strong password and two-factor authentication) requires your cooperation. "Safe" on this page refers to software and account security, not a guarantee of trading outcomes. Report a vulnerability or ask a question: support@merini.com