Security
Under lock and key.
Your broker password is encrypted before it even leaves your device, and we never keep it. Here is what protects your access, your account and your data.
Encrypted before it leaves.
Your password is encrypted in your browser, decrypted for a few milliseconds on our server, then passed to the technical provider that runs the copy. It is never written on our side.
- Encrypted in your browser before it is sent: what travels is unreadable, and the key that opens it never leaves our server
- Decrypted in memory, just long enough to pass it on, then gone: nothing is ever written to a disk on our side
- Held by the technical provider while your account is linked, and deleted the moment you disconnect it
- On our side, only your account number and your server are recorded
What Javlot cannot do.
Four things Javlot does not do. Not as a promise: by construction.
Move your funds. The technical provider can place and close orders on your account, and read it. Nothing else. A deposit or a withdrawal happens between you and your broker, with your own access.
Keep your password. It is written nowhere on our side, not even encrypted. Our database knows your account number and your server, nothing more.
Advise you. No strategy is tied to your profile. You choose, you set, you change whenever you like.
Decide for you. Nobody at Javlot steps in on your account. Your limits apply on their own, with no one having to watch.
Your account, double-locked.
Turn on two-factor authentication: a stolen password is no longer enough to get in.
- A six-digit code from the authenticator app of your choice
- Set up in a minute: scan a QR code, enter a first code
- Mandatory for our own team, from their first sign-in
- You are notified every time it is turned on or off
Your data stays yours.
It lives in Europe, each piece tied to its owner, and disappears the day you decide.
Hosted in Europe. Your data lives on servers in the European Union, encrypted at rest and in transit. GDPR applies, and nothing is ever sold to anyone.
Sealed, account by account. Every row in our database belongs to its owner, and the database itself refuses it to anyone else. A provider knows you follow their strategy, never your balance or your gains.
Erased when you decide. One button in your dashboard deletes your account: subscriptions cancelled, connections cut, personal data erased. And on request, you get a copy of your data.
We will tell you.
A security incident never stays between us: you are told, the affected connection is cut, and a report is published.
If something goes wrong
- You are told directly, promptly after detection
- The affected connection is cut while it is put right
- A written report is published on javlot.io
Found a flaw?
- Write to security@javlot.io
- A reply within two business days
- No legal action against a good-faith researcher who follows responsible disclosure
14-day free trial
Your access stays yours. Your capital stays with your broker.
Create your account, link your broker account and turn on two-factor authentication: you are set in a few minutes.
This page describes Javlot security posture at a high level. It is not a substitute for the terms of use or privacy policy, both of which carry the legally binding language. If a clause on this page conflicts with the legal documents, the legal documents take precedence.