Where your money is, where your keys are, and what leaves your computer
Your broker connection and your rules run on your own computer, not in the cloud. Your BrokerBridge never receives your Interactive Brokers login. You type it into Interactive Brokers' own app on your computer, and BrokerBridge talks to that app over a local connection that does not leave your machine. The app itself still signs in to Interactive Brokers over the internet, as it must. Some other things do need the internet: creating your BrokerBridge account, buying AI credits, and sending trade context to whichever AI provider you picked. The rest of this page lists exactly what goes where.
The selected provider and the features you turn on determine where AI request data is processed.
Your local trading runtime, and optional cloud services
The desktop app runs a local FastAPI service and connects to IB Gateway or TWS on your machine. Depending on what you turn on, it can also make outbound calls to:
- •The AI provider you selected, or the BrokerBridge managed-model plane when managed credits are turned on
- •BrokerBridge account, activation, entitlement, wallet, and billing services for features you turn on
- •IB Gateway or TWS on loopback for broker operations
Key point:Broker credentials stay at the local broker boundary. AI prompts can include the market, trade plan, position, and rule context needed by the workflow you turned on. Review the selected provider's terms and the in-product request boundary before turning it on.
Credential encryption
Encryption algorithm
Fernet (AES-128-CBC with HMAC-SHA256) from the pyCA cryptography library.
Key derivation
PBKDF2-HMAC-SHA256 with 480,000 iterations. Keys derived from your machine fingerprint.
Storage
Encrypted credentials stored in system keyring (macOS Keychain, Windows Credential Manager, or Linux Secret Service).
Machine fingerprint binding
- •Credentials cannot be decrypted on a different machine
- •License is tied to one installation at a time
- •Switch machines by re-entering credentials; license auto-rebinds
What data is sent to AI providers
May be included for the task
- • Symbol and direction
- • Price bars (OHLCV data)
- • Signal scores and evidence
- • Anonymized portfolio risk metrics
Not model-prompt inputs
- • Interactive Brokers login credentials
- • AI provider secrets or API keys
- • Website and Stripe credentials
- • Desktop activation grants
- • Raw payment-card data
With a direct provider or local Ollama, BrokerBridge uses that selected route. With managed credits, the request is processed through the BrokerBridge managed-model plane and metered against your verified wallet. The managed-credit path is unavailable while its default-off service is not enabled.
Software distribution and IP
BrokerBridge is installed on yourcomputer. Anything that runs locally can be inspected by a motivated user; that is true for any Python (or compiled) desktop app. There is no magic "encryption" that lets the program run while hiding all logic from the machine owner.
What we do provide
- • TLS (HTTPS) for the website and any download links we host, so bits are not sent in cleartext over the internet.
- • Account and activation controls for connected use; you can start with practice money without an account.
- • Optional managed-credit controls through a server-owned wallet and metered model plane when that service is turned on.
- • No secrets in the wheel. API keys and broker credentials stay in your local env, not baked into packages.
How companies usually protect client-side IP
- • License and terms. Copyright, subscription agreement, and enforcement against redistribution.
- • Keep the crown jewels server-side. Not applicable to a fully local trading desk; anything shipped in the installer can be studied.
- • Optional obfuscation. Tools like PyArmor, Nuitka, or Cython raise the cost of copying; they deter casual ripping, not a skilled reverse engineer.
Bottom line: treat legal protection and subscription value as the primary defense; treat optional obfuscation as a speed bump, not encryption that blocks all analysis.
Security middleware
Security headers
X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy, Permissions-Policy, HSTS.
Rate limiting
100 requests per 60 seconds per IP. Returns 429 with Retry-After header.
License validation
Every API request checked against license status. Invalid licenses return 403.
Admin authentication
Admin routes require Bearer token via BROKERBRIDGE_ADMIN_TOKEN env var.