How PatternX protects your account, data and trades

Measures in place in PatternX's code today:

• Passwords are stored only as bcrypt hashes.
• Exchange and broker credentials (API keys, secrets, passphrases and hosted IBKR gateway logins) are encrypted at rest with AES-256-GCM under their own dedicated key. Once saved, a key is shown only as a masked preview, and data exports never contain credentials in readable form.
• Two-factor authentication is optional and works with any TOTP authenticator app. Its secret is also encrypted with AES-256-GCM, and turning 2FA off requires a valid code.
• Session cookies are signed, httpOnly (page scripts cannot read them), Secure and SameSite=Lax, and expire after 7 days. Account status is checked on every request, so a suspension applies at once.
• Password-reset and verification links are single-use and expire, and only a hash of each is stored.
• Audit logs record sign-ins, failed sign-ins, 2FA changes, password resets, connection changes and data exports.
• Rate limits per IP address protect sign-in and the account and trading API.
• Row-Level Security is on for every database table, so the database's built-in data API denies access by default.
• Trade-only API keys. Create keys with withdrawals disabled. Where an exchange reports that permission, PatternX warns you about a key that can withdraw and will not switch that connection to live trading.

The privacy policy sets out your rights under the EU and UK GDPR and US state privacy laws. In practice:

• Self-service access and deletion. From Settings you can download everything PatternX holds about you as a JSON file, or delete your account, without a support ticket. Deletion needs your password, is refused while a live position is open, so its stop is never left unwatched, and cancels a card subscription at Stripe first, so a deleted account is never charged again. Invoice records that tax law requires are kept only as pseudonymous figures.
• Your other rights. You can correct data, restrict or object to processing, withdraw consent for marketing email, Telegram or push alerts, and complain to a supervisory authority. Written requests are answered within one month under the GDPR.
• No advertising. PatternX runs no advertising and does not sell personal data.
• Anonymous counts. PatternX's own measurement keeps daily totals, such as how many visitors each website sent, recorded by domain only, with no cookie or identifier stored for it. Third-party analytics cookies are set only if you accept them.
• Card details stay with Stripe. Card payments are made on Stripe's own checkout page, so PatternX never receives your card number.
• Sub-processors. The services that process personal data for PatternX are listed, with their purpose and region, on the sub-processors page.

PatternX documents how each signal is produced, with the real thresholds, so you can check its output instead of taking it on trust.

Three disclosures matter most when you read a signal. The latest bar may still be forming when a pattern is detected. The probability shown with a signal is a heuristic derived from its confidence, not a measured win rate. And the per-pattern reliability priors in the score are fixed values, not statistics. Research studies publish their methods first; results appear only when real data supports them.

PatternX AI (Pro and Elite) is a fixed formula that evaluates setups the deterministic engine has already detected. It does not detect, find or invent patterns, it is neither machine learning nor a language model, and it makes no external calls. It scores 8 factors from 0 to 100, with fixed weights:

The result can veto a setup or re-weight its confidence. It never changes stops, targets, position size or execution.

Large language models write signal explanations, reports, lessons, backtest write-ups and assistant answers from the data each text covers. They never detect patterns, check risk or place orders, and they are instructed not to give buy or sell advice. See the AI context layer.

PatternX's risk safeguards, and what each one does:

These controls reduce risk; they cannot remove it. A stop can fill beyond its price in a gap, a stop-limit order may not fill at all, trailing stops on the signal engine depend on PatternX running and reaching the venue, and paper fills are simulated. Read the risk disclaimer and the risk controls methodology before trading live.

PatternX never holds your funds. Money stays at the exchange or broker you connect. PatternX reads balances and places, protects and closes orders through your API connection; it has no function that withdraws or transfers funds.

What is stored, and for how long, as set out in the privacy policy:

Where it lives. The application runs on Render (United States / EU, per service region), and the database is PostgreSQL at Supabase, in the region of PatternX's database project. The email, payment, alert and AI-text providers are listed with their regions on the sub-processors page.

PatternX runs as a web application plus a separate background worker, both hosted on Render. Account, trading, billing and audit records are kept in a PostgreSQL database run by Supabase. Both providers are listed, with their regions, on the sub-processors page.

The worker runs the pattern scanner, Momentum Lab, backtests and the position manager. The position manager checks open positions every 5 seconds and reconciles live positions with each venue every 60 seconds, and a watchdog alerts you when a live position cannot be priced. Where the data comes from is described in market data.

Other providers each do one job: Resend delivers email, Stripe and NOWPayments process payments, Telegram delivers alerts if you link a chat, and a language-model provider writes AI text. The exchange or broker you connect is not a PatternX sub-processor; it handles your orders under its own terms and privacy policy.

• Service status. The Status link in the site footer opens a machine-readable check of whether the PatternX application and its database are responding.
• Support. The support page answers common questions about connections, the scanner, Momentum Lab, risk controls, billing and security, and gives the support email address. Signed-in users can also message support from the dashboard.
• Privacy and data rights. The privacy policy gives the privacy contact address. Export and deletion are self-service in Settings, and written requests are answered within one month under the GDPR, or 45 days under US state privacy law.
• If a key may be exposed. Revoke it at your exchange or broker first, then tell support. PatternX's support assistant is instructed never to ask for passwords, API keys, secrets or two-factor codes, so do not send them.
• Press. Media questions go through the press page.