Trust Center
MetaTrader API connects your software to MetaTrader 4 and 5 accounts. This page explains who runs it, where your data lives, how it is protected and what happens when something breaks. It describes what we actually do today; we do not hold ISO 27001 or SOC 2 certifications and do not claim to.
Who we are
MetaTrader API is operated by Apex Vanguard Dynamics LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States, a limited liability company registered with the Wyoming Secretary of State under Filing ID 2025-001713271 (registry link in the imprint: https://www.metatraderapi.net/en/imprint/). Data protection contact: Robin Jones, support@metatraderapi.net. The Service is offered to businesses only.
Where your data is
| What | Where |
|---|---|
| Account data, connected MetaTrader accounts, API servers | European Union (Finland, Germany) |
| Encrypted database backups | European Union |
| DNS, TLS and DDoS protection (Cloudflare) | Global edge network |
| Payments (Stripe) | Ireland / USA |
| Inbound email (Proton) | Switzerland |
Full list of subprocessors and transfer safeguards: Data Processing Agreement, Annex 3 (https://www.metatraderapi.net/en/dpa/).
How we protect it
- TLS on every connection; HSTS on all our hosts.
- Broker passwords and two-factor secrets encrypted at rest with AES-256-GCM; account passwords stored only as salted scrypt hashes.
- Each connected MetaTrader account runs in its own isolated container with fixed memory and CPU limits.
- Server administration only through a private network with personal keys; there is no public SSH access.
- Our internal tools read customer data through a read-only database role that cannot see passwords or broker credentials.
- Two-factor authentication for your dashboard account; API keys can be limited to a single MetaTrader account; rate limits per key.
- We do not read or analyse the content of your API requests.
Availability and capacity
- Live status and incident history: https://status.metatraderapi.net/.
- Every server is health-checked every two minutes; a server that stops answering is taken out of service automatically and new capacity is added when free capacity runs low.
- We publish a written post-mortem on the status page after every incident that affects customers.
Backups
- The production database is backed up every night, encrypted with AES-256, and kept for 14 days.
- Restores are tested; the date of the last successful restore test is recorded internally and available on request.
Incidents
If a security incident affects your data, we notify you without undue delay and within 48 hours of becoming aware of it (see DPA section 8), tell you what happened, what data is affected and what we are doing about it, and follow up with a post-mortem.
Your documents
- Terms and Conditions (versioned, B2B): https://www.metatraderapi.net/en/terms/
- Data Processing Agreement (GDPR Art. 28, accepted with the Terms): https://www.metatraderapi.net/en/dpa/
- Privacy and Cookie Policy: https://www.metatraderapi.net/en/privacy/
- Responsible disclosure policy: https://www.metatraderapi.net/en/security/
- Security questionnaires: we answer them; write to support@metatraderapi.net.
Support
- Live chat on this site and in the dashboard, email support@metatraderapi.net.
- First response within one business day (Monday to Friday); urgent outages are monitored around the clock.
- Questions are answered by people; we will tell you if an answer was drafted with an AI tool.