Trust
Security
Risk Marshal connects to trading accounts, so we hold ourselves to a simple standard: collect the minimum, encrypt what we store, and be precise about what we can and cannot access.
Credentials
Your own MT5 setup: your trading password stays in MT5. Optional investor access is read-only and cannot place, modify or close trades.
Managed hosting: to sign in to your account and apply the financial limits you authorize, Risk Marshal needs your trading credentials. They are encrypted when stored and are used for your managed account connection.
In both modes, Risk Marshal cannot withdraw, deposit, or transfer funds — broker platforms do not expose funds movement to trading terminals, and we never ask for banking or wallet credentials.
Your data
- You own your trading data. You can export it or delete it at any time.
- We never sell or rent personal data. Aggregated, anonymised benchmarks are opt-in only.
- Behavioural signals (breaches, sessions, discipline scores) are scoped to your account and visible to others only if you invite them — for example an accountability partner or coach.
- Retention and processing details are documented in the Privacy Policy.
Platform practices
- Connections to Risk Marshal use encrypted communication.
- Browser protections help prevent other sites from embedding the dashboard or loading unauthorized content.
- Payments are handled by our payment processor — card details never touch Risk Marshal servers.
- Access to production systems is restricted.
Responsible disclosure
Found a vulnerability? Email support@riskmarshal.com with [Security] in the subject. Include steps to reproduce and give us a reasonable window to fix the issue before public disclosure — we take reports seriously and respond to every one. Machine-readable details live at /.well-known/security.txt.
The honest limits
Security is a practice, not a badge. We don't currently hold formal certifications such as SOC 2, and we won't imply otherwise. What we commit to is minimal collection, encryption of sensitive data, truthful documentation, and fast response when something is wrong. Questions we haven't answered here: ask us directly.