Security model
PlugTrade executes your TradingView alerts on your own VPS, next to your MT5 terminal. That architecture is the security model: your orders have no reason to travel through us, so they don't. This page documents precisely what runs where, what leaves your machine, and what never does — every statement below is checked against the shipped code before it's published. Last verified: July 2026.
Your broker password never touches PlugTrade
PlugTrade never asks for, stores, or transmits your broker password. There is no MT5 password field anywhere in the app, and the database that holds your bridges has no password column.
Instead of logging into your account, PlugTrade attaches to the MT5 terminal you have already logged in on your VPS. It auto-discovers running terminals and their accounts; you pick from that list. If no account is logged in on a terminal, PlugTrade reports exactly that and does nothing. Your broker login stays between you and MetaTrader.
Exactly what leaves your machine
A fully honest list — most tools publish none of this. Four kinds of outbound connection exist, and none of them carries your trades to us:
1. License check-in — at startup, then about once a day
The app confirms your license seat with our license server. The payload is:
- •License key
- •Install ID (a random UUID for seat counting)
- •Account email (only if you set one) — optional
- •VPSLink role + name (only if you link multiple VPS) — optional
No account numbers, no trades, no balances, no trade counts. That is the whole list.
2. Webhook address setup — when licensed
To give your VPS a stable HTTPS webhook address (yourname.vps.plugtrade.io), the app asks a public "what's-my-IP" service for your VPS's own public address, registers it with our DNS endpoint, downloads the Caddy web server once from its official site, and obtains a TLS certificate from Let's Encrypt. This is address plumbing for inbound TradingView alerts — it carries your VPS IP and license key, nothing about your trading.
3. Mobile push notifications — only if you pair a phone
Off by default. If you pair the mobile app, trade notifications (symbol, direction, volume, price, SL/TP, ticket) are delivered to your phone through Expo's push service. Don't pair a phone and this path does not exist.
4. Multi-VPS linking — only if you enable it
VPSLink forwards signals between your own VPS machines. It is off by default and connects only to peers you configure — never to us.
What never leaves
- •Your broker password — never asked for, never stored, never sent
- •Your trades and trade history — executed and journaled locally (SQLite on your VPS)
- •Your account balance, equity, or positions
- •Your strategy: alert contents are processed in memory on your machine
The desktop app ships no analytics, no telemetry, no crash reporting. There is no tracking SDK in the application. TradingView alerts arrive inbound at your VPS and are executed locally — the receive path has no code that forwards them anywhere.
Licensing that respects offline
Your license is an Ed25519-signed token, verified locally against a public key built into the app. What your plan entitles you to is read from that signature — not from anything a network call has to confirm. If our license server is unreachable, your app keeps trading on the signed token; when the token expires, you get a further 7-day offline grace period.
And if the license can't be confirmed after all of that, PlugTrade blocks new entries only. Closing positions, modifying stops, and managing whatever is open keeps working. Your open positions are never held hostage to a license check.
Secrets encrypted at rest
Your webhook tokens and signing secrets are stored encrypted (Fernet: AES-128-CBC with HMAC-SHA256 authentication; the key is derived with PBKDF2-HMAC-SHA256 at 100,000 iterations). Every install generates its own secret key on first run — the installer ships none, so no two installs share one.
Honest limits: the encryption key lives on your machine, next to the data it protects. That guards your secrets if the database file is copied off the box; it cannot guard against someone with admin access to the VPS itself. No fully-local design can — anyone claiming otherwise is selling you something.
The webhook endpoint
For TradingView to reach your VPS, PlugTrade's webhook receiver is network-facing by design. It is defended in layers:
- •Every bridge gets its own unguessable secret token in the webhook URL — and you can rotate it anytime
- •Optional per-bridge HMAC signatures with replay protection, on every plan
- •Rate limiting per token and per source IP
- •Optional source-IP allowlist
- •Real HTTPS via an automatically provisioned Let’s Encrypt certificate
Found something? Tell us.
If you believe you've found a security issue in PlugTrade, email support@plugtrade.io with "Security" in the subject. We read everything and we answer.