This page explains how AXSentinel handles the data a broker connects to it. The binding terms are the data processing agreement in each broker’s contract with AXFintech; where they differ, the agreement wins.
Roles
The broker decides why and how its clients’ data is used and is the controller. AXFintech processes that data only to run AXSentinel for the broker and is the processor. We do not use a broker’s data for any other customer, for marketing, or to train models.
What the platform processes
- Trading-account data read from the broker’s MT5 server: login, name, email, group, leverage, balances, equity, margin, last IP address, country and client ID.
- Trading activity: open positions, pending orders, deals, deposits, withdrawals and credit operations.
- Liquidity-provider data the broker connects: LP positions, fills and account balances.
- Optional CRM data the broker sends: client profile, KYC status, introducing broker, payments and copy-trading links.
- Platform users’ names, work emails, roles, sign-in history and an audit trail of their actions.
Access to MT5
AXSentinel reads MT5 through AXFintech’s MT5 Manager bridge or an on-premise agent the broker runs. Brokers are asked to create a dedicated manager login and can keep it read-only. Changes to MT5 (moving a client to another group, changing leverage, closing positions, hedging at an LP) happen only through actions the broker’s own users request and approve, or through automation the broker switches on; every one is recorded.
Security
- Encryption in transit (TLS) for every connection to the platform.
- Connection secrets (bridge keys, LP credentials, alert-channel tokens) encrypted at rest and never shown again after saving.
- Each broker’s data is separated by tenant on every query.
- Role-based access, optional mandatory two-step sign-in, and an append-only audit log of user and engine actions.
- Database backups every six hours, verified and copied off-site, with restores tested.
Sub-processors
We use service providers for hosting, backup storage, DNS and email delivery. If a broker enables them, alerts and reports are also sent through the channels the broker chooses (for example email, Telegram, Slack, WhatsApp or the broker’s own webhook), and AI-assistant questions are sent to the AI provider the platform uses. The current list is available on request and in the data processing agreement; brokers are told before a new sub-processor is added.
Retention and deletion
- Equity snapshots older than 90 days are deleted automatically; other trading data is kept while the broker’s subscription is active.
- When a broker’s contract ends, its data is returned or deleted as set out in its data processing agreement; deleted data leaves the backups as they expire.
Incidents
If we become aware of a personal data breach affecting a broker’s data, we notify the broker without undue delay so it can meet its own obligations, and share what we know as we learn it.
Requests from clients
If a broker’s client contacts us about their data, we pass the request to the broker. We help brokers answer access, correction and deletion requests that involve data held in AXSentinel.
Contact
Questions about data processing: info@axfintech.io.