Security and compliance
You are connecting real money to Cirrus. Here is what protects it, in plain terms, and how to tell us if you find a problem.
Certified and empanelled
Independent audits and exchange empanelment, not self-assessed badges.
- ISO/IEC 27001 certified
- Our information security management system is certified against ISO/IEC 27001.
- SOC 2 Type 2 compliant
- An independent auditor has tested how our security controls operate over a period of time, not on a single day.
- NSE & BSE empanelled algo vendor
- Cirrus is empanelled with both exchanges as a vendor of algorithmic trading technology.
How we protect your accounts
Broker connections
- Where your broker offers an official login page (OAuth), you sign in on the broker's own site, so Cirrus never sees your broker password.
- Access tokens and API keys you connect are encrypted at rest and only used to place and track the orders you ask for.
- Most brokers end API sessions daily, so each account is reconnected at the start of the trading day. You can revoke access from your broker at any time.
Your Cirrus login
- Sign in with a passkey on your device, or with a one-time code sent to your email or phone.
- See every device that is signed in to your account and sign any of them out from Settings.
- All traffic between your browser, Cirrus and your broker is encrypted in transit.
A static IP for every account
How static IPs work- Each connected account's orders leave from its own dedicated IP, which you whitelist with your broker, as SEBI requires for retail API trading.
- Your broker only accepts API orders for that account from the IP you registered.
Protection on every order
Order protection- Attach a stop-loss, target and trailing stop once; every account that took the trade gets it.
- Each order is checked against the broker's rules for that account before it is sent.
- Every order keeps a log with timestamps for each step, so you can see what happened and when.
API and webhooks
API documentation- API keys and webhook secrets are shown once when issued or rotated, and can be revoked at any time.
- Outgoing webhooks are signed so your server can verify they came from Cirrus.
- Signal and webhook delivery logs record the outcome, not the payload. Payloads are never stored.
Found a security issue?
Email support@cirrus.trade with "Security report" in the subject. Include the steps to reproduce it and what an attacker could do with it. We will confirm we have received it and keep you updated while we fix it.
Please only test against your own account, do not access or change other people's data, and give us reasonable time to fix the issue before sharing it publicly.
Connect your first broker in about five minutes
Sign in, link an account, and place your first multi-account order. Pocketful users pay nothing.