Autonomy, bounded on purpose.
Handing a language model a brokerage account is a genuinely dangerous idea.
What an agent can do with your money
The model never holds credentials
Agents call named tools; the platform executes them server-side. Your brokerage tokens are AES-256-GCM encrypted with a key held only as a worker secret — the database alone is useless without it. No model, and no prompt, ever sees them.
Limits live on the order path
Per-trade size, per-day spend, trades per day, symbol allow and deny lists, and market-hours checks are enforced in code between the agent and the broker. An order that breaks one is refused with a reason the agent can read — and that refusal is written into the run transcript.
Paper before real, always
Every agent starts on simulated cash at live prices, settling against a paper book with hard cash accounting. Going live requires a connected brokerage and a deliberate switch, and editing an agent drops it back to paper.
Outside data is data
What a third-party tool returns — a webhook, an MCP server — reaches the model framed as data, never as instructions, and every order it inspires still passes the same limits on the order path. Whether it places or proposes is your approval setting, not the tool’s.
One switch stops everything
The kill switch halts every agent and system on your account. Orders carry deterministic reference IDs the broker deduplicates, so even a repeated tick cannot double-trade, and a global daily spend cap bounds the whole account regardless of how many agents are running.
What happens to your account and your data
Your account is yours alone
Every row of every table — agents, fills, portfolios, runs, tools, skills — is scoped to your user and enforced by row-level security in the database itself, not by a check in application code that a bug could skip. Another account cannot read your positions even if the app asks it to.
Secrets are encrypted, not just stored
Brokerage tokens and tool credentials are encrypted at rest with AES-256-GCM. The key lives as a platform secret, never in the database and never in the repository, so a copy of the database is not a copy of your access.
We do not train on your data
Your agents, transcripts and positions are not used to train models. Prompts go to the model provider you chose for that step and come back; nothing is retained for our own training, and nothing is sold.
Sign-in without a password
Accounts use an emailed link rather than a password, so there is no password of yours for us to store, leak, or ask you to rotate.
Published means published
Nothing you build is visible to anyone until you publish it, and publishing shares the workflow and its record — never your keys, your book, or your balances.
Every decision is recorded
Runs persist the full transcript: each thought, tool call, and result, with the market context behind it. Fills are a ledger, which is why performance on Discover is computed from what actually happened rather than from a claim.
What none of this does
None of it makes trading safe
Guardrails bound how much you can lose per order and per day; they cannot stop a strategy from being wrong, a model from misreading a market, or a position from gapping against you overnight. Traderunner is preview software, is not audited, and is not a broker or an adviser. Every order placed from your account is yours. Trade money you can afford to lose.