Security and control for your trading accounts.

Tradovate and NinjaTrader connections use OAuth 2.0. When you connect a broker, you authorize MimikTrader through the broker's own login screen. We never see your broker password.

The broker returns short-lived access tokens and a refresh token. Those tokens are what MimikTrader uses to place copy orders, read fills, and check account state. You can revoke access from your account settings or directly from the broker side at any time.

When you disconnect a broker, the stored tokens are deleted from our database and the connection stops working immediately on our end.

Tokens are sealed with AES-256-GCM before they are written to the database. The encryption key lives only in server-side environment variables — it is never exposed to the browser, included in client bundles, or printed in logs.

Without the key, sealed tokens cannot be unsealed, even by someone with database access. Each token blob carries its own IV and authentication tag, so tampering is detectable.

We do not store broker passwords. We do not store your credit card directly — payments are processed by Stripe and the card details never touch our servers.

MimikTrader records copied orders, fills, rule events, flatten actions, and account locks with timestamps. The journal is per-account so you can review exactly what happened on a specific account, on a specific day, and what triggered each action.

Connection events — broker connects, disconnects, token refreshes — are recorded separately so you can confirm when your account was authenticated to which broker.

MimikTrader runs in the cloud. There is no VPS to rent and no local machine to keep running for the system to operate.

Database storage uses managed PostgreSQL in the same region as the application. Backups run on the database provider's standard schedule. Encryption keys are stored as platform secrets, separately from the database.

Application traffic is served over HTTPS only. HTTP requests are upgraded to HTTPS automatically.

You are responsible for verifying your prop firm's current rules, configuring the right limits per account, reviewing your copy groups before live trades, and making your own trading decisions.

Software enforcement helps reduce avoidable rule breaches. It does not remove trading risk and does not guarantee prop firm compliance, account approval, payouts, or evaluation success.

Keep your MimikTrader login secure. Use a strong password, enable two-factor authentication, and revoke any device or session you no longer recognize.