Vectixs is a free paper-trading site. You never connect an exchange account or give us an API key, and no real orders are placed for you. What we protect is your account: your email address, your password and what you write in the forum.
These are not promises we could quietly change. They follow from how the product is built.
The server refuses to store an exchange API key for any visitor account. Your exchange accounts stay entirely outside Vectixs, so there is no key of yours here for anyone to steal.
Every balance is simulated. There are no deposits and no withdrawals, and nothing is for sale: the server answers every request to start a paid plan with "not found".
If you turn on two-factor authentication, its secret is encrypted before it is written to the database, using authenticated encryption, so a tampered value is detected rather than decrypted. Recovery codes are stored only as hashes.
The approximate country and city in our visitor log come from a location database stored on our own server. Your IP address is not sent to an outside service to look it up.
Including the gaps. A security page that only lists strengths is not worth reading.
Passwords are stored as bcrypt hashes. We cannot read your password, and a password reset lets you set a new one rather than recovering the old.
You can turn on app-based two-factor authentication from your profile page. It works with any standard authenticator app and comes with single-use recovery codes in case you lose your phone. It is optional.
The site is HTTPS only and tells browsers to refuse plain HTTP. Your session is a signed, HTTP-only, Secure cookie, so page scripts cannot read it and it is never sent over an unencrypted connection.
Five failed attempts on an account locks further tries on it for five minutes, and two-factor codes have a lockout of their own. That makes guessing a password or a code impractical.
Administrative pages are enforced on the server for every request, not by hiding buttons in the browser. There is no client-side check to bypass.
Sign-ins, sign-outs, failed sign-ins, account changes, forum actions and administrator actions are logged with the time, IP address and browser. The log is kept for 90 days, as Thailand's Computer Crime Act requires, and then deleted automatically.
Your profile page lists recent page visits made while signed in to your account, with the IP address, approximate location and browser of each. If something there is not you, change your password.
Every post and comment has a Report button for signed-in users, and anyone can email support@vectixs.com. Each report goes to a review queue with a 24-hour target for removing scams, impersonation and other unlawful content.
There are no sign-in alert emails yet. Until there are, the visit list on your profile page is the place to check for a sign-in that was not you.
There is no money to take and no exchange key to steal. Every balance is simulated, and visitors never give us a key. What an attacker could reach is account data, such as usernames, email addresses, password hashes and paper-trading history. Passwords are stored as bcrypt hashes, which are slow to crack. Use a password you do not use anywhere else, and turn on two-factor authentication.
No. Vectixs is a paper-trading site. You trade with simulated money against live public prices, and no real orders are placed for you. The server refuses to store an exchange key for any visitor account.
Yes. You can turn on app-based two-factor authentication from your profile page. It works with any standard authenticator app and gives you single-use recovery codes in case you lose your phone. It is optional.
Your username, avatar and forum posts and comments are public. Your paper trades are not. The leaderboard is off by default, and if you turn it on, only signed-in users can see it. The site operator can see account details and logs in order to run and secure the site.
From your profile page, which asks for your password first. Your account and paper-trading data are deleted. Your forum posts stay, shown as coming from a deleted account, and the activity log is kept for 90 days as Thailand's Computer Crime Act requires. The Privacy Policy has the details.
Written by the person who builds and runs Vectixs. Read the background, or start paper trading for free with no exchange account at all. Security questions: support@vectixs.com.