Security

Corvexsa cannot trade. Not "does not". Cannot.

Every AI product promises to behave. A promise is worth what the company behind it is worth. This page is about something narrower and more useful: what this software is physically able to do with your brokerage account, and how you can check it without taking our word for anything.

Last updated 5 September 2026

Prove it, right now

The button below asks our live server to attempt the exact things we say it cannot do: buy a share, sell a share, cancel an order, change a pie, withdraw funds, read your trade history, and fetch holdings from an address that is not your broker.

These are real attempts through the same function every legitimate read goes through. They are safe to run against a live account, because none of them reaches Trading 212. That is the thing being demonstrated.

What it can and cannot do

• ✓
  Read which shares you hold, and what you paidThe portfolio the advisor reasons about.
• ✓
  Read your uninvested cash balanceSo a suggestion is never larger than what you could actually fund.
• ✓
  Read which instruments your account can buy as real sharesSo it never suggests something your broker will not sell you.
• ✕
  Place a buy or sell orderThere is no function in this codebase that can send one.
• ✕
  Cancel or amend an existing orderSame reason. The guard permits GET and HEAD, and nothing else.
• ✕
  Change an auto-invest pieRefused before any network connection is opened.
• ✕
  Withdraw, deposit or transfer moneyCorvexsa never holds your money and never touches a payment rail on your behalf.
• ✕
  Read your trade, dividend or transaction historyWe refuse keys that grant it. The advisor does not need your withdrawal record to tell you that you are concentrated in technology.

How the refusal actually works

Every request Corvexsa makes to a broker passes through one function. Nothing else in the codebase is permitted to contact a broker, and that function has five rules, all of which fail closed:

1. The method must be a read. GET or HEAD. There is no branch in that function that can emit a POST, PUT, PATCH or DELETE to a broker, so no bug elsewhere in the system can produce one.
2. The address must be your broker. A fixed list of hostnames, so a mistake or an injection cannot walk your credentials somewhere else.
3. The path must be one of three endpoints. Holdings, cash, and the instrument list. An endpoint that is not on the list is refused even when it is a read, because unnecessary reads leak too.
4. The request carries no body. A body on a read is a contradiction, and it is refused before anything else happens.
5. Redirects are refused, not followed. A redirect cannot be used to carry an authenticated request off the allow-listed host.

This is why the proof above is meaningful. It is not testing a policy someone remembered to apply. It is testing the only door.

The advisor is a writer, not an actor

The part of Corvexsa people think of as "the AI" is a language model that writes prose and fills in a fixed answer schema. It is given exactly four tools, and every one of them does the same kind of thing: return a structured answer for the app to display.

It has no tool that calls an API, executes code, or takes an action of any kind. This matters more than it sounds. A model that decided to trade for you would have nothing to do it with, in the same way that a book cannot spend your money however strongly it recommends a purchase. You can read the list of tools it is given in the attestation.

Separately, and for a different reason: the model is never asked to compute a number. Every figure you see comes from deterministic arithmetic over your real holdings and a real market feed. The model explains numbers. It does not produce them.

We refuse API keys that are too powerful

When you connect Trading 212, you generate an API key and choose what it can reach. Corvexsa needs three permissions: Portfolio, Account and Metadata. If your key has more than that, we do not store it. We tell you which permission to remove and ask for a new one.

Why bother, when the guard already makes the extra power unusable to us? Because a key that can trade is a different object to hold on your behalf than a key that cannot. If our storage were ever breached, the damage a leaked key could do is decided entirely by what you ticked when you made it. So we insist on the small one.

The one thing we do not check, and why

Trading 212 has no endpoint that reports a key's own permissions, so we detect them by asking: we send a read to each permission we do not want, and see whether it answers or refuses. That works for every permission except one. Detecting the permission that places orders would mean sending an order-shaped request to your real account, and we will not do that under any circumstances to prove a point about not doing it.

In practice this costs you little. Trading 212 grants the two order permissions together, so refusing a key that can read orders refuses nearly every key that can place them. And where it does not, the guard is the backstop: Corvexsa has no code that can send an order, whatever your key permits.

We would rather tell you the edge of what we can verify than let you assume it does not exist.

Your credentials, at rest

• Encrypted with AES-256-GCM. The key lives in the server environment, never in the database, so reading our storage is not enough to read a single credential.
• Bound to your account. Each encrypted credential is cryptographically tied to your account ID and the field it belongs to, so a record cannot be moved between accounts even by someone with full storage access.
• Never sent back to a browser. Not to yours, not to anyone's. There is no screen in Corvexsa that displays a stored API key, because there is no endpoint that returns one.
• Excluded from your own data export, deliberately. Writing a live credential into a downloaded file creates a copy neither of us controls.
• Revocable without us. Delete the key in Trading 212 and Corvexsa stops working immediately. You never have to ask our permission to end this.

The rest of the account

• Everything is scoped to one account. Every stored record is keyed by your account ID, and every endpoint verifies your session before it reads one.
• Your conversations are not training data. Not for our models, not for anyone else's. See Privacy for what each provider is contractually held to.
• A browser policy that pins where data can go. The app is only permitted to send data to four named addresses, so script injected into the page has nowhere to send your portfolio.
• Your own access log. Inside the app, under Security, you can read every event on your account: sign-ins, broker reads, blocked writes, exports. It is the same log we have, not a summary of it.
• Export and erasure in one click each. No email, no waiting period, no support ticket.

What this page is not claiming

Trust pages become worthless when they overreach, so here is the boundary.

• We have not been independently audited, and we do not hold SOC 2 or ISO 27001. When that changes we will say so here with a date and a report, and not before.
• The proof above shows the code running on this server refuses these operations. It does not prove the code running here is the code we published. Pin the guardFingerprint in the attestation and hold us to it if it moves.
• The app front end allows inline scripts, because it is one self-contained file with inline handlers throughout. That is a real limitation, not an oversight, and removing it means rewriting the front end.
• Corvexsa is not a broker, a bank or a licensed financial adviser. Nothing it produces is a personal recommendation in the regulatory sense. See Terms.

Reporting something

If you have found a way to make Corvexsa do something this page says it cannot, we want to hear about it before anyone else does. Write to security@corvexsa.com. We will confirm receipt within two business days, we will not threaten you, and we will credit you if you want to be credited.