One terminal, one container
- Every terminal runs in its own container with its own filesystem, its own platform installation and its own memory and CPU limits. Nothing is shared between two customers' terminals.
- Containers on a server cannot talk to each other. That is enforced by the network they are on, not by a rule inside them.
- A terminal has no route into the private network the servers use to talk to each other, and the server drops such traffic at its own firewall.
- Containers run with Linux capabilities dropped and privilege escalation blocked, on a read-only root filesystem.
Your broker password
- Encrypted before it is stored, and stored nowhere else. There is no password column on a terminal row.
- Delivered to the platform through a file that lives only in memory and is deleted the moment the platform has read it.
- Never written to a log or an error message. An automated test searches our log output for a known password on every build and fails the build if it finds one.
- Every decryption is written to an audit record, with who asked and when.
Opening a terminal
- A session link carries a signed token and no terminal identifier, so there is nothing in the address to change and nothing to guess.
- Tokens are short lived, at most an hour, stored only as a hash, and revocable. Revoking one closes the connection that is already open, not only future ones.
- The connection is TLS from your browser to us, and the token never appears in a query string, so it does not end up in a proxy log or a referrer header.
Your Terminalive account
- Passwords are hashed with Argon2id and are not recoverable by us.
- Sign-in and password reset are rate limited, and a reset tells you nothing about whether an address has an account.
- Your session cookie is signed and encrypted, carries no account details, and is refused the moment it stops verifying.
How we run it
- Servers accept SSH by key only. Passwords and root login are refused.
- The database is backed up every night, with broker passwords still encrypted inside the backup. Restoring one into a brand new empty server is rehearsed rather than assumed, and the rehearsal compares what comes back against a record written when the backup was taken.
- A copy of each backup is kept with a second provider, in the European Union, so losing our hosting account does not lose the data. The nightly job refuses to report success unless that copy actually arrived, and the copy is read back and compared rather than trusted.
- A watchdog checks every five minutes that backups are recent, that servers are reporting, and that terminals are not stuck, and alerts a person when they are not.
What this does not protect you from
Saying this plainly is worth more than a longer list of things that are true.
- Anyone with a session has full keyboard and mouse control of the terminal. They can stop an expert, close a position, or read the files inside it. Do not share a link.
- Code you install runs with your terminal's privileges inside your container. We do not review it, and a program you did not write can do whatever your terminal can do, including reaching the internet.
- On the standard plans, terminals on one server share an outbound address, which some brokers and most funded-account programmes treat as coordinated trading.
- Multi-factor authentication on your Terminalive account is not available yet. It is being built. Until it is, your password is the only thing between someone and your terminal, so make it a long one you use nowhere else.
- We are not certified against any external security standard, and we will not claim to be before an auditor says so.
Reporting something
If you find a security problem, write to the security address at the bottom of this page. We will acknowledge within two working days and tell you what we are doing. We will not take legal action against anyone who reports a problem to us in good faith and does not take other people's data while finding it.
Who we are and how to reach us
Signalync LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA. These terms are governed by the law of the State of Wyoming.
General and privacy questions: support@terminalive.com. Security reports: security@terminalive.com