Security practices

Your broker credentials

The broker API keys and daily session tokens you connect are encrypted with AES-256 before they’re stored, locked to your account, and never sent back to your browser — not even to you. You log in on your broker’s own page, so MyAlgoAgent never sees your broker password, PIN or login 2FA codes. If you choose Groww’s automatic login, its API TOTP secret gets the same encryption and is used only to start your daily session. You can disconnect at any time, and MyAlgoAgent never holds your money.

Encryption

Every connection is encrypted with HTTPS, and your account data is encrypted at rest in secure AWS cloud infrastructure in India.

Your account

• Passwords are stored only as one-way hashes — nobody at MyAlgoAgent can read yours
• Sign in with a password, an email link or Google; sessions are protected and can be signed out any time
• Repeated attempts are rate-limited to protect your account from automated attacks
• Every trading action is checked on our servers, so limits can’t be bypassed from the browser

Who at MyAlgoAgent can see your data

• Only a small, named team, each with the least access their role needs — support staff can answer you, only administrators can act on an account
• Nobody on the team can see your password, your broker keys or tokens, or your conversations with your AI agent
• Every action the team takes — including opening your account details — is recorded with who did it and when

Payments

Payments are taken by Razorpay, a licensed payment provider, in its own secure window. Your card, UPI or netbanking details go to Razorpay and never reach MyAlgoAgent. We check every payment’s signature with Razorpay before crediting anything, and we keep only the payment reference, amount and invoice, so a payment can be matched and refunded safely.

Monitoring & backups

The platform is monitored around the clock and our team is alerted within minutes if something goes wrong. Your data is backed up automatically every day, and every update is tested automatically before it goes live. Every risk-limit breach and kill-switch block is recorded and sent to your notifications. Keys and passwords are never written to our logs, and anything like that pasted into the AI chat is hidden before it’s saved.

Coming soon A full audit log of sign-ins, account changes, strategy changes, broker connections and trading actions.

Safe failure states

If a broker API, market-data provider or internal service becomes unavailable, the platform is designed to stop new trading actions rather than guess, and to surface the failure clearly instead of failing silently.

Reporting a security issue

If you believe you’ve found a security issue, please contact us through the details on the Contact page so it can be investigated promptly.