Security
Automation you can stop.
A trading system is a security system first. This page describes what Wands does today, in plain terms, without certification claims we cannot back up.
Credentials
- Exchange and broker API keys are stored encrypted at rest and are never sent to the browser.
- Keys are used only by server-side processes that need them, and are never written to logs.
- You can revoke a connection at any time, which deletes the stored credential.
Trading permissions
- Every connection starts read-only. Trading permission is a separate, explicit grant per connection.
- Withdrawal and transfer permissions are never requested and are not supported.
- A single control halts every bot and cancels open orders across all accounts.
Access and audit
- Accounts are provisioned by invite during the private beta; there is no public sign-up.
- Orders, signals and configuration changes are recorded with a timestamp and an actor.
- Sessions are server-validated on every request; the client never holds authority over identity.
Data handling
- Market and filing data is sourced from public records. Your positions, watchlists and backtests are private to your account.
- Waitlist and contact submissions are stored only to operate the beta and respond to you.
- You can request deletion of your account and associated data at any time.
Status
What we do not claim.
Wands is an independent product in private beta. We do not hold third-party security certifications today. When that changes, the certificates and their scope will be published on this page rather than implied in marketing copy.
If you are evaluating Wands for a fund or an institution and need a written security questionnaire completed, use the contact form and select Security review. We will answer in writing.
Private beta
See the evidence before you see the price.
Join the private beta. We onboard in small cohorts so every account gets supported properly.