How we protect your access.
Javlot reads your broker account through credentials you provide. Here is how they are protected, what surrounds them, and what happens if something goes wrong.
We never store your credentials.
Your password is encrypted on your device, used for a few milliseconds to open your connection, then forgotten on our side. Here is what happens at each step.
Encrypted before it leaves
Your login, password and server are encrypted inside your browser with a 4096-bit RSA-OAEP public key. What travels across the network is already unreadable ciphertext.
Encrypted ciphertextDecrypted in memory only
The private key lives only on our server, in an environment variable the rest of the application cannot read directly. Your credentials are decrypted in memory just long enough to open the connection. Nothing is written to disk.
In memory, millisecondsHanded to the execution layer
The password is passed to the execution layer that opens and maintains your live MT5 connection, so positions can be copied to your account in real time.
Held only while connectedNothing is stored
Javlot keeps no copy. Our database stores only your account number and server name, never your password, not even encrypted.
Zero password at restWhat we store, what we never store
- Your MT5 password
- Any plaintext credential at rest
- Your password in our database, even encrypted
- Your MT5 account number (login)
- Your broker server name
- Connection status and validity flags
The encryption, in plain terms
Encryption uses RSA-OAEP with a 4096-bit key pair and SHA-256. The public half does the encrypting, inside your browser, using the Web Crypto API. The private half lives only on our server, in an environment variable the rest of the application cannot read directly.
Because the decrypted value only ever exists in memory during the connection step, there is no password sitting in our database for anyone to steal, encrypted or not. The key pair can also be rotated on our side without any change to how you use the platform.
Two-factor authentication
Account login uses the Supabase Auth flow with email and password. Two-factor authentication is live: you can enable TOTP (a six-digit code from an authenticator app) as an account-level opt-in from your account security settings. Enrollment is a one-time QR-code scan, and once it is confirmed, every future login on your account asks for a fresh code.
We strongly recommend turning it on. Alongside 2FA, the best baseline remains a unique, high-entropy password not reused on any other site, combined with the password manager of your choice. The login route also rate-limits brute-force attempts.
If something goes wrong
We commit to disclose security incidents that materially affect user accounts within a reasonable window of detection. If an account connection is compromised, every affected user is contacted directly, the impacted connection is invalidated, and a written incident summary is published on the Javlot domain.
If you discover a vulnerability, write to security@javlot.io. We acknowledge reports within two business days and do not pursue legal action against good-faith researchers who follow standard responsible-disclosure practice.
GDPR and your data
Javlot is a French SAS. GDPR applies. Users can request a full data export or full account deletion from the dashboard. The deletion flow disconnects your broker accounts (which deletes the credentials held for them at the execution layer), clears your sessions, and erases your personal identifiers, retaining only the minimum position history required for accounting and audit obligations.
We do not sell user data. We do not share user-identifiable position history with strategy providers: providers see their own positions on their source account, not the positions taken on user-side copies. Cookies used on the marketing site are limited to analytics that can be opted out of.
Where to go next
This page describes Javlot security posture at a high level. It is not a substitute for the terms of use or privacy policy, both of which carry the legally binding language. If a clause on this page conflicts with the legal documents, the legal documents take precedence.