Security architecture

A trading workstation with clear trust boundaries.

QuantStation separates presentation, trusted execution, and user strategy code so sensitive state stays within the layer designed to handle it.

Local by defaultIsolated workersExplicit execution

Trusted boundaryQuantStation

React interface

Renders the workstation and user intent. It does not own broker credentials or trusted execution state.

Rust host

Owns validation, local persistence, jobs, authenticated I/O, secure sessions, and high-impact broker actions.

Isolated strategy workers

User Python runs in child processes behind bounded messages without Firebase tokens or broker credentials.

Trusted services

Entitlements, provider secrets, remote assets, and AI credentials remain behind authenticated server contracts.

Principles

Security is a system design choice.

Credentials stay out of the interface

React never needs broker credentials or provider tokens. Secure handling belongs to trusted runtime layers.

Execution requires intent

Live commands are validated, confirmed, and completed only from authoritative order and fill events.

Private work starts local

Journals, notebooks, playbooks, voice notes, attachments, and AI history begin in a private local store.

Remote assets are verified

Authenticated versions are owner-scoped and checksum-verified before becoming local research inputs.

AI secrets remain server-side

Model selection and provider credentials never become desktop configuration or strategy context.

Recovery respects ownership

Backup and restore validate schema and owner identity before private records or attachments are accepted.

No vague promises

QuantStation documents what is local, what is remote, and which layer owns every sensitive action. We do not describe any system as invulnerable.