ForgeX Trading

Security and your data

ForgeX asks some of you to connect a brokerage account so your journal fills itself in. That is a serious thing to ask for, so this page sets out exactly what we take, what it is used for, what it cannot do, and how to end it.

Who we are, and who we are not

ForgeX is an independent backtesting and journalling tool. We are not a broker, we do not hold your money, and we are not affiliated with, endorsed by, or operated by any broker or prop firm named anywhere on this site. Names like Tradovate, Rithmic, MetaTrader, DXtrade, MatchTrader, FTMO or Topstep appear here only to say which platforms we can read a trade history from. They are the trademarks of their owners.

The only place ForgeX runs is forgextrading.com. We will never email you a link to a different domain asking for a login, and no part of ForgeX will ever ask for your broker password anywhere except the connection screen inside your own logged in account.

What a broker connection can and cannot do

One of our connection methods, Tradovate, uses your platform login. The others never see it at all. In every case the access is limited to reading history. It reads your account list and your filled trades, and that is the whole of it. It cannot place, change or close a trade. It cannot move money. It cannot change your account settings or your password, and it cannot open or close accounts.

How a stored login is protected

A stored login is encrypted on our server before it reaches the database, using strong, current encryption, so a row lifted out of the database on its own cannot be read. The key that protects it is never in the database and never in the browser. It is never shown again after you save it, to you or to us. Delete the connection and the stored login goes with it, and changing your password at the broker also ends our access immediately. For Tradovate you can skip sharing your password entirely by creating a free API key instead.

The browser add-on

Rithmic, DXtrade and MatchTrader use a small Chrome add-on. It asks for one permission, storage, where the sync token you paste in is kept. It has no access to your files, your other tabs, your browsing history, your camera, your microphone or your location. It runs on five trading sites and ours, and nowhere else. It reads the trade history your own browser has already loaded and sends only that to your ForgeX journal, using a token you generate and can revoke. Every line of it is readable plain JavaScript.

The files we offer, and how to check them

ForgeX offers three downloads and no others: the Chrome add-on as a zip, and the MetaTrader 4 and 5 helpers as .mq4 and .mq5 files. The MetaTrader files are plain-text source code you can read before you use them. Nothing downloads on its own, every download shows a SHA-256 before you take it, and there are no installers, bundled extras or toolbars.

Your account with us

Your account is served only over HTTPS, with HSTS, and with framing by other sites blocked. Your ForgeX password is stored as a salted hash we cannot read. Payments are handled by Stripe, so card numbers never reach our servers. Ask us to delete your account and we delete the trades, the journals and any stored broker credentials with it.

Reporting a problem

If you find a security issue, please tell us before telling anyone else, at management@forgextrading.com. We will not pursue anyone who reports something in good faith and does not access other people's data while doing it. If you got here because something on ForgeX looked untrustworthy, we would genuinely rather hear about it. That is a bug too.

Trading involves risk of loss. ForgeX is a research, practice and record keeping tool. Nothing on this site is financial advice, and no result shown in a simulation is a prediction of a real one.