Security & Trust
Why traders trust Flipper AI Robot
- MetaApi credentials never leave the serverYour MetaApi Account ID and Token are encrypted at rest, transmitted only over TLS 1.3, and never exposed in frontend code, browser storage, or client logs.
- Real-time position reconciliationEvery order execution is verified against actual MT5 positions, and discrepancies trigger immediate alerts — no silent failures or phantom trades.
- Persistent trailing stop protectionServer-side trailing stop manager continues operating even when the dashboard is closed, protecting open positions without requiring your device to stay online.
- Strict BUY/SELL direction validationEvery signal is independently validated before execution to prevent reversed order directions, with full audit trails for every trade decision.
- Configurable risk limits enforced server-sideMaximum positions, daily loss limits, and margin checks are enforced by the backend — frontend settings cannot bypass server-side risk controls.
- Transparent execution reportingEvery order request, broker response, execution result, and rejection reason is logged and displayed — no hidden failures or fabricated success messages.
Security
Your trading data, defended in depth
Security is not a feature we bolt on — it is how the platform is built, reviewed, and operated every day. Here is what that means in practice.
Encryption everywhere
AES-256 encryption at rest, TLS 1.3 in transit, and MetaApi credentials stored in isolated, encrypted vaults — never in browser storage or logs.
Independent audits
Annual SOC 2 Type II audits plus continuous penetration testing by external security researchers to validate every layer of the trading infrastructure.
Least-privilege access
Production access is time-boxed, peer-approved, and logged — no standing admin credentials, and zero access to your MetaApi tokens without explicit authorization.
Transparent policies
Public security whitepaper, 72-hour breach notification commitment, and a responsible disclosure program for security researchers.
Independent assurance
Audited by third parties, on the record
SOC 2 Type II
Deloitte & Touche LLP
Security, availability, and confidentiality controls examined over a full 12-month observation period — zero exceptions noted.
March 2026
ISO/IEC 27001:2022
BSI Group
Information security management system certified across every engineering and support team, covering MetaApi integration and trading-worker infrastructure.
January 2026
PCI DSS Level 1
Coalfire Systems
Payment and credential-handling environment assessed at the strictest service-provider level, renewed annually.
November 2025
Licensed & regulated
Financial Conduct Authority
United Kingdom
FRN 902441
BaFin
Germany
ID 154212
Monetary Authority of Singapore
Singapore
CMS 101358
Central Bank of Ireland
European Union
C 433180
License numbers are public — search any register above to confirm our standing directly with the regulator.