FRAPropHQ
SECURITY OVERVIEW

Keep permissions narrow and control obvious.

FRA Prop HQ is a founding beta, not a bank or broker. The security approach is to collect less, keep private credentials server-side and give users a clear route to disconnect and delete.

AUTHENTICATION

Email and password

Supabase Auth manages account sessions. Confirmation email and password-reset mail are delivered through the configured SMTP provider.

DATABASE ACCESS

Row Level Security

Customer-facing database operations are restricted by authenticated user policies. Privileged service operations remain in server functions.

CONNECTION TOKENS

Server-side and encrypted

Provider access, refresh and identity tokens are not placed in the frontend. Sensitive stored tokens are encrypted using AES-GCM with an application-managed server key.

AI PROVIDER

Backend-only API access

FRA AI requests are sent from a Supabase Edge Function. The OpenAI API key is never shipped in the website files or exposed to the browser.

DATA MINIMISATION

What the product needs

Typical stored data

  • Login identity and product profile
  • Prop account identifiers, balances and rule settings
  • Imported or connected executions and trade reviews
  • Fees, payouts and approved bank transaction details
  • Connection state, import logs and support diagnostics
  • AI prompts, responses, usage totals and selected analysis context when FRA AI is used

Not part of the product

  • No custody of trading funds
  • No bank-payment initiation
  • No customer NinjaTrader or Tradovate passwords
  • No customer order routing
  • No sale of customer trading records
USER CONTROL

Disconnect and delete

Members can disconnect supported provider or bank connections from the dashboard. Account deletion is available in Settings when the live backend is configured. A support-based deletion route is documented for cases where self-service deletion fails.

No online product can promise absolute security. The beta will continue to add monitoring, incident handling and legal review before a wider paid launch.

PROVIDER DATA BOUNDARY

Raw records stay server-only

The v6.16 connector mirrors provider accounts, orders, fills, fill pairs, fees, positions, cash balances and cash logs into service-only tables. Browser roles have no access to those raw payloads. Members receive only the safe account-selection, sync, reconciliation and diagnostic views needed to control their own connection.

The real-time worker is disabled by default and does not connect to market-data feeds or expose order-placement functions.

Report a security concern

Include the page, time, browser and what happened. Do not email passwords, access tokens or private API keys.

Send security report
RISK DISCLOSURE

Futures and forex trading contains substantial risk and is not for every investor. An investor could potentially lose all or more than the initial investment. Risk capital is money that can be lost without jeopardizing one's financial security or lifestyle. Only risk capital should be used for trading and only those with sufficient risk capital should consider trading. Past performance is not necessarily indicative of future results.

HYPOTHETICAL PERFORMANCE DISCLAIMER

HYPOTHETICAL PERFORMANCE RESULTS HAVE MANY INHERENT LIMITATIONS, SOME OF WHICH ARE DESCRIBED BELOW. NO REPRESENTATION IS BEING MADE THAT ANY ACCOUNT WILL OR IS LIKELY TO ACHIEVE PROFITS OR LOSSES SIMILAR TO THOSE SHOWN; IN FACT, THERE ARE FREQUENTLY SHARP DIFFERENCES BETWEEN HYPOTHETICAL PERFORMANCE RESULTS AND THE ACTUAL RESULTS SUBSEQUENTLY ACHIEVED BY ANY PARTICULAR TRADING PROGRAM. ONE OF THE LIMITATIONS OF HYPOTHETICAL PERFORMANCE RESULTS IS THAT THEY ARE GENERALLY PREPARED WITH THE BENEFIT OF HINDSIGHT. IN ADDITION, HYPOTHETICAL TRADING DOES NOT INVOLVE FINANCIAL RISK, AND NO HYPOTHETICAL TRADING RECORD CAN COMPLETELY ACCOUNT FOR THE IMPACT OF FINANCIAL RISK OF ACTUAL TRADING. FOR EXAMPLE, THE ABILITY TO WITHSTAND LOSSES OR TO ADHERE TO A PARTICULAR TRADING PROGRAM IN SPITE OF TRADING LOSSES ARE MATERIAL POINTS WHICH CAN ALSO ADVERSELY AFFECT ACTUAL TRADING RESULTS. THERE ARE NUMEROUS OTHER FACTORS RELATED TO THE MARKETS IN GENERAL OR TO THE IMPLEMENTATION OF ANY SPECIFIC TRADING PROGRAM WHICH CANNOT BE FULLY ACCOUNTED FOR IN THE PREPARATION OF HYPOTHETICAL PERFORMANCE RESULTS AND ALL WHICH CAN ADVERSELY AFFECT TRADING RESULTS.

NinjaTrader® and Kinetick® are registered trademarks of NinjaTrader, LLC. FRA Prop HQ is an independent third-party journalling and analytics service and is not a broker, futures commission merchant or investment adviser.