Security at Edgelog
Edgelog is designed to help you review trading data without asking for permissions that can place or close trades. Here is the security model in plain language.
Last reviewed: September 2026
Read-only by design
The EdgelogSync MT4/MT5 Expert Advisor reports closed positions and never opens, closes, or modifies broker orders. Binance and Bybit connections use read-only API keys; disable trading and withdrawal permissions when creating a key.
- We do not ask for MT4/MT5 master passwords.
- Exchange secrets are encrypted before storage and are used only for the selected sync.
- CSV and Excel imports can be used when you prefer no live connection.
Account isolation
Trading records, notes, screenshots, and playbooks are scoped to the signed-in account. Server routes authenticate before reading or writing private data, and database policies provide an additional owner boundary.
- Private workspace and admin routes are excluded from search indexing.
- Public reviews show only approved, featured content.
- You can export your history and delete your account from the supported flows.
The interactive demo is synthetic
The public demo uses fixed sample trades and a short-lived, HttpOnly preview cookie. It never reads your Supabase account and it does not accept writes or credentials. Authenticated visitors are sent back to their own dashboard so demo state cannot mask or mix with real workspace data.
Responsible disclosure
If you find a security issue, email info@edgelogtrading.com with the affected URL, steps to reproduce, and a safe way to contact you. Do not include passwords, API secrets, or another user’s private data in a report. We will acknowledge a credible report and investigate it.
Security model
See how each boundary works
Connections are designed for data collection, not trade execution.
The MT4/MT5 EA reports closed positions. Exchange keys should be configured read-only, with trading and withdrawal permissions disabled.