Security

This page explains where every piece of data lives and why. It is written for traders and for the compliance team of a prop firm. If anything is unclear, write to us — we are happy to explain the architecture.

Password on your PC only

You type it on your machine. Windows encrypts it (DPAPI) and the desktop app verifies it against the terminal. Our servers keep the nickname, server and login — never the password. The encrypted copy is tied to your Windows login — as safe as your Windows password, no safer. Lock your account.

Outbound only

The desktop app opens a TLS connection to us. We never connect into your PC. Nothing listens on your network — the app talks to the terminal over localhost only. No port forwarding, no firewall rule.

Pair with a code, revoke in a click

A 6-digit code, valid 10 minutes, single use. Every device gets its own token. Unpair it from the web and it is cut off at once.

A key per webhook

Every webhook has its own 32-character key. A call without it is rejected before anything runs, in constant time. Rotate it any time. TradingView cannot set headers, so the key travels in the body over TLS.

Terminal stays local

The MetaTrader 5 bridge listens on 127.0.0.1 only, one per account, each with a fresh token per session. Nothing on the network can reach it.

Your machine, your IP

Orders leave from your own PC and your own terminal, the same way a manual trade does. Prop-firm rules differ — read yours; we are happy to explain the architecture to your firm.

Stays on your PC

broker password (DPAPI)
device token
MetaTrader 5 session
local trade mirror (SQLite)

Shared with the web app

account nickname, server, login
balance / equity snapshots
open positions and floating P&L (every 60 s)
trades and realized P&L
signal payloads and trace events

	Hookmode	VPS + EA bridge	Cloud copy-trader
Broker password lives	on your PC, encrypted	on a rented disk	uploaded to the vendor
Orders leave from	your PC, your IP	the VPS	the vendor’s servers
Extra monthly infrastructure	none	$20–60	bundled in the fee
Setup	minutes	hours	account review
See what happened	trace per signal	RDP + logs	what the vendor shows
Dashboard from any device	yes	RDP only	yes

How the password reaches the terminal

The app hands the password to the MetaTrader 5 terminal through a local connection on the same machine (127.0.0.1), protected by a one-time token per session. It never leaves the machine.

The device channel

The desktop app connects out to us over a TLS WebSocket with a bearer token. Our servers store only a SHA-256 hash of that token — a database leak does not expose a usable credential. Unpair the device from the web and the token is dead at once.

The webhook key

Each webhook has its own secret. It travels in the request body over TLS and is compared in constant time on the server. Rotate it any time. A webhook accepts 60 requests per minute, and a duplicate alert inside 60 seconds is ignored.

Your Hookmode sign-in

Sign-in to the web app is handled by Clerk. The web account can unpair devices, change rules and fire manual trades — protect it like you protect your broker account.

Updates

The desktop app downloads updates over HTTPS from our storage and verifies a checksum before installing. The installer is not yet signed with a publisher certificate, so Windows SmartScreen warns on the first run.

Who builds this

Hookmode is built and run by one independent developer — no company yet, no outsourced support. The person who wrote the code reads every email.

Questions from your firm?

We answer architecture questions from any prop firm. Send them this page, or write to us directly. hello@hookmode.com

Join the waitlist