QuantSuite runs entirely on your machine — a local engine serving a local terminal. Your strategies, broker keys, positions, and the AI that reasons over them all run locally. The app phones home to nothing. This page lays out exactly how that works — and is honest about what we have and haven't done.
The terminal is a local app, not a thin client to our servers. There is no account sync, no telemetry pipeline, and no cloud copy of your book.
The AI analyst and voting agent run as a local model on your own GPU/CPU. Prompts, positions, and market context are assembled and inferred entirely on-device — no request ever goes to an external LLM API. Your reasoning stays private.
You connect your own broker and data accounts — Alpaca, Finnhub, Tradier and others. Those keys live in local config on your disk, used to talk directly from your machine to your providers. NinjaTrader connects through its local ATI file bridge rather than a key, and FRED needs no credential at all. We never receive, proxy, or store them.
The running application makes no outbound calls to QuantSuite servers for analytics, usage tracking, or "features." License validation is offline (see below). The only network traffic is between your machine and the providers you explicitly connected.
Buying a license does involve a server. Here is precisely what that backend touches — and what it deliberately never sees.
Card data goes directly to Stripe and never touches our servers. We store no card numbers, CVCs, or full PANs. We receive only what Stripe returns to reconcile a purchase — enough to issue and support your license, nothing more.
A locked-down backend holds your email, your plan, the license key we issued you, and the contents of any support ticket you send. That's the full list. It exists to deliver your key and help you when you write in.
Provider API secrets — your broker and data credentials — live in local config on your machine or in server-side environment configuration, never in client code and never in the shipped app. The one secret that is compiled into the installer is the licence-verification key, because licences are verified offline on your machine with no call to us; it verifies licences and reaches no provider and no account of yours. It is never exposed to the browser.
Concrete measures already in the codebase — not aspirations.
User-authored strategy code runs behind an AST guard that blocks dynamic attribute access and dangerous builtins, so a strategy can't break out to touch your filesystem or shell.
The local API enforces trusted-host checks, so a malicious web page in your browser can't quietly reach the terminal's loopback service and drive it.
A redaction layer scrubs secrets before anything is written to logs, so your broker and data keys don't leak into diagnostic output or crash reports on disk.
License keys are HMAC-signed and verified on-device. Activation needs no phone-home and no account server — the signature proves validity offline. Enforcement is real: on expiry the app locks its features behind a lock screen until you renew, and your local data is never touched while locked.
The built-in data console is read-only against your local stores. You can inspect and query your own data; the console can't be used to mutate or corrupt it.
Every order path is gated by a risk kernel with a one-click kill switch. The app paper-trades only when you explicitly arm it — nothing places an order on its own, and live trading is not part of this version.
Found a vulnerability? We want to hear about it before anyone else does. We won't pursue researchers acting in good faith.
Email security@quantsuitepro.com with a description, reproduction steps, and impact. Please give us a reasonable window to remediate before public disclosure. A machine-readable /.well-known/security.txt with our current contact and policy will be published alongside this page.
We will not claim a certification we don't hold. QuantSuite is not SOC 2, ISO 27001, or otherwise formally certified today, and we display no third-party trust badges we haven't earned.
Current status: [independent third-party audit — planned, not yet completed]. When an external review is completed, we'll publish its scope and findings here rather than a logo.
Also on the roadmap, stated rather than implied: machine-bound activation. Today the license key alone is the credential — a deterrent against casual sharing, not DRM — exactly as described on the pricing page.
The same honesty that governs our performance numbers governs this page. If a claim isn't true yet, it's marked — not implied.