Security practices

Your broker credentials

The broker API keys and daily session tokens you connect are encrypted with AES-256 before they’re stored, locked to your account, and never sent back to your browser — not even to you. By default you log in on your broker’s own page, so MyAlgoAgent never sees your broker password, PIN or login 2FA codes. If you choose Groww’s automatic login, its API TOTP secret gets the same encryption and is used only to start your daily session. For Dhan and Angel One there is an optional automatic daily login that, only if you tick a consent box, keeps your PIN and 2FA secret sealed with a separate encryption key, used only to sign in for you and never shown again; anyone holding both could log in to that account, so turn it on only if you accept that. You can disconnect at any time, which deletes them, and MyAlgoAgent never holds your money.

Encryption

Every connection is encrypted with HTTPS, and your account data is encrypted at rest in secure AWS cloud infrastructure in India.

Your account

• Passwords are stored only as one-way hashes — nobody at MyAlgoAgent can read yours
• Sign in with a password, an email link or Google (which always asks which account to use); one active sign-in per account, so a new sign-in ends the old one, and you can sign out any time
• Repeated attempts are rate-limited to protect your account from automated attacks
• Every trading action is checked on our servers, so limits can’t be bypassed from the browser

Who at MyAlgoAgent can see your data

• Only a small, named team, each with the least access their role needs — support staff can answer you, only administrators can act on an account
• Nobody on the team can see your password, your broker keys or tokens, or your conversations with your AI agent
• Every action the team takes — including opening your account details — is recorded with who did it and when

Payments

Payments are taken by Razorpay, a licensed payment provider, in its own secure window. Your card, UPI or netbanking details go to Razorpay and never reach MyAlgoAgent. We check every payment’s signature with Razorpay before crediting anything, and we keep only the payment reference, amount and invoice, so a payment can be matched and refunded safely.

Live orders

• On a paid plan your orders leave from your own static IP, created for you and registered on your broker account, so your broker sees one stable, known address
• Every order is checked on our servers first: kill switch, per-order and daily limits, duplicate protection
• An order is recorded before it is sent and confirmed with the broker afterwards, so it is never sent twice or guessed at
• A readiness check proves your broker, login and IP are in order without placing any order

Email you can trust

Our emails are sent from our own domain with SPF, DKIM and DMARC set up, so they can be verified as ours. We never ask for your password, API keys, PIN or one-time codes by email or in chat. If you reply to one of our emails, your reply becomes a numbered support request that our team answers.

Monitoring & backups

The platform is monitored around the clock and our team is alerted within minutes if something goes wrong. Your data is backed up automatically every day, and every update is tested automatically before it goes live. Every risk-limit breach and kill-switch block is recorded and sent to your notifications. Keys and passwords are never written to our logs, and anything like that pasted into the AI chat is hidden before it’s saved.

Coming soon A full audit log of sign-ins, account changes, strategy changes, broker connections and trading actions.

Safe failure states

If a broker API, market-data provider or internal service becomes unavailable, the platform is designed to stop new trading actions rather than guess, and to surface the failure clearly instead of failing silently.

Reporting a security issue

If you believe you’ve found a security issue, please contact us through the details on the Contact page so it can be investigated promptly.