Security

What ACondor does with your account

ACondor authenticates to tastytrade through the official OAuth API. Using that connection, the bot does exactly four things:

• Reads market data: option chains, Greeks, IV rank, and quotes.
• Reads your account: positions, balances, buying power, and order status.
• Places, modifies, and cancels options orders in the accounts you connect.
• Stamps every order it creates with a client tag so its own positions can always be told apart from trades you placed yourself.

ACondor never calls any money movement endpoint. It does not initiate withdrawals, deposits, ACH transfers, or wires, does not change your linked bank account, does not update your account profile, and does not open or close brokerage accounts. There is no code path in the software that does any of those things.

Enforce this yourself rather than taking our word for it. tastytrade lets you choose which scopes an OAuth application receives when you create it. Grant only the scopes required for reading data and trading, and the broker will reject anything else at the API boundary regardless of what any software asks for.

Where your credentials are stored

Connecting an account means supplying a tastytrade OAuth refresh token and client secret. Together these grant full API access to that brokerage account, which is why the documentation tells you to treat them like a password.

Planned, hosted model. On managed infrastructure your broker credentials are not stored in your application database at all. They live in Azure Key Vault, a dedicated hardware-backed secrets service. The bot authenticates to Key Vault using a managed identity, which means there is no key, password, or secret file sitting on the server for an attacker to find. Credentials are fetched at session start, held in memory only, and every access is logged. If we ever need to cut off access, the identity's permission is revoked centrally and every instance loses the ability to read the secret immediately, with no redeploy.

This design is deliberate. Keeping the credential out of the database entirely is stronger than encrypting it inside the database, because a stolen database backup then contains no credential to decrypt in the first place.

Today, during early access. If you run ACondor yourself without a Key Vault configured, credentials fall back to a row in your own bot database or an environment variable on your own machine. In that configuration they are not encrypted at the application layer, and their security is the security of the machine you control. This is a real limitation and it is a large part of why the hosted model exists.

In every configuration, resolved credential values are never written to logs, never included in an API response, and never displayed back in the dashboard after you enter them.

One thing we will not claim: your broker credentials are encrypted, not hashed. Hashing is one-way and irreversible, which is right for passwords but impossible here, because the software has to recover the original token to talk to tastytrade on your behalf. Any trading product that tells you it hashes the credentials it trades with is describing something that cannot work. What protects yours is that the secret is held in a separate hardened service, reachable only by an identity we can revoke, rather than sitting in a database next to your data.

Identity and sign-in

Planned. Sign-in is handled by Microsoft Entra External ID, an enterprise identity provider, rather than by a login form we wrote ourselves.

The practical consequence is the part worth understanding: we never store your password, because we never receive it. You authenticate directly with the identity provider and ACondor only ever sees the resulting token. There is no password in our database to hash, leak, crack, or reuse, and a breach of our systems cannot expose one. Multi-factor authentication, password policy, and account recovery are handled at the identity provider, at a standard we could not match by building it ourselves.

The same sign-in carries through to your bot dashboard, so there is no second, weaker password protecting the system that places your trades.

Encryption

In transit. Every connection is encrypted with TLS: your browser to acondor.com, your browser to your dashboard, the bot to tastytrade, and the bot to its own database. Nothing about your account or your trading crosses a network in the clear.

At rest, Planned. On managed hosting, your database and its backups are encrypted at rest with AES-256 at the storage layer by the cloud platform. This protects against the physical and infrastructure-level cases: a decommissioned disk, a copied storage volume, a stolen backup file.

We want to be precise about what that does and does not do, because "encrypted at rest" is often used to imply more than it delivers. Storage-level encryption is transparent to anyone who can legitimately query the database, so on its own it would not protect a credential from someone who obtained database access. That is precisely why your broker credentials are kept out of the database entirely and held in Key Vault, as described above. The two controls answer different threats and we are not going to present one as if it covered the other.

Isolation between customers

Planned. Your bot is its own environment. Every customer gets a dedicated application instance and a dedicated database, provisioned separately and running separately. Not a shared application that filters by customer, and not a shared database with a customer ID column. Separate infrastructure per customer.

This matters more than it sounds. The most common way one customer's data reaches another is a single missing filter in a single query, and every multi-tenant application is one code review away from that bug. When your database contains only your data, that entire class of bug cannot produce a cross-customer leak, because there is no other customer's data present to leak. It is a structural guarantee rather than a promise about our code quality.

The same applies to compute. Your bot does not share a process, a memory space, or a runtime with anyone else's, so a crash, a runaway position, or a compromise in one customer's instance does not reach yours. Your credentials are scoped to your instance alone and are never shared across deployments.

Revoking access

You can cut ACondor off from your brokerage account at any time, and you do not need us to do it or to be online for it to work:

1. Sign in at my.tastytrade.com and go to Manage, then API Access, then OAuth Applications.
2. Revoke the application. The refresh token dies immediately and every subsequent API call from the bot fails at the broker.

Revocation happens at tastytrade, not at ACondor, so it holds even if our software is malfunctioning. Stopping the bot from the dashboard toggle is the faster everyday control, but revoking the token is the one that does not depend on us.

Revoking access stops new activity. It does not close positions that are already open. Anything the bot has already placed remains your position and remains your responsibility to manage.

What leaves your account, and where it goes

Two parts of ACondor send data to Anthropic's API, and they are worth separating because they behave very differently:

The news classifier sends headlines only. Financial news text is scored for sentiment, direction, and impact. No positions, balances, account numbers, or credentials are included in those requests. This runs automatically.

The dashboard chat panel sends your account context, and can act on your account. When you use the chat panel, it can read your positions, settings, news, and the bot's decision history in order to answer you, and it can take actions such as changing settings. That data goes to Anthropic as part of the conversation. This only happens when you choose to use the chat panel. If you never open it, none of that data is transmitted.

Neither path puts a language model in the automated trade entry or exit decision. Every entry and exit rule the engines run is deterministic. Claude scores news and answers your questions; it does not decide your trades.

Who we share data with

These are the third parties that may process your data, and what each one receives:

We do not sell, rent, or trade your data. We do not share your positions or trading performance with anyone, and we do not publish customer results.

Operational access and logging

• Administrative access to production is limited to the operator of ACondor and is used for provisioning, billing, and incident response, not for reviewing your trading.
• Secrets, credentials, and tokens are excluded from application logs by design.
• We will never ask you for your tastytrade password, your ACondor password, or a two-factor code. Any message that does is not from us. Support is conducted against sandbox and paper configurations wherever possible, never by asking for live credentials.

Retention and deletion

Your bot configuration and trade history live in your dedicated database for as long as your subscription is active. When you cancel, you may request full deletion of your instance and its database by writing to [email protected], and we will action it and confirm in writing. Backups roll off on their own retention cycle after that.

Deleting your ACondor data has no effect on records held by your broker. tastytrade retains your order and tax history under its own regulatory obligations, independent of us.

Incidents

If we confirm a security breach affecting your credentials or personal data, we will notify you by email within 72 hours of confirming it, describe what we know and what we do not yet know, and tell you exactly what to do, which in most cases means revoking your tastytrade OAuth application immediately.

We would rather send an early notice that turns out to be less severe than we feared than a late one that was polished first.

Reporting a vulnerability

Email [email protected] with enough detail to reproduce the issue. We will acknowledge within three business days and keep you updated until it is resolved.

Please do not test against another customer's instance, access data that is not yours, run denial of service tests, or use social engineering against us or our providers. Report it first and give us reasonable time to fix it. We will not pursue legal action against researchers who follow that and act in good faith.

What we do not claim

ACondor has not undergone a SOC 2 audit, a penetration test by an independent firm, or any third-party security certification. We are not going to display badges we have not earned. If that changes, this page changes with it.

No system is perfectly secure, including this one. The controls above reduce risk, they do not eliminate it. The strongest protection available to you is the one entirely in your hands: limit the OAuth scopes you grant, and revoke them the moment anything looks wrong.

Questions

Security questions go to [email protected]. Everything else goes to [email protected].