Security
How Nyria protects your accounts
Nyria places orders in a brokerage account you own. This page is what that connection can reach, how the credentials behind it are held, and where that work is still unfinished.
Connections to your broker
We use OAuth where the broker supports it. That covers Schwab, tastytrade, and live Tradier accounts. You authorize Nyria from inside the broker. We never see your password.
Alpaca and Tradier paper accounts work on an API key and secret you generate at the broker and paste in. We store those. Create them with the minimum permissions you need, and turn off withdrawals where the broker offers that toggle.
You can revoke our access from your broker's dashboard at any time. Disconnecting on the broker side immediately invalidates the token or key we hold.
What the connection can and cannot do
The permission Nyria holds is trading access to the account you connected. Here is that permission, in both directions.
- Place an order on the account you connected
- Cancel an order it placed
- Read positions, balances and buying power, to size the next one
- Withdraw money
- Transfer cash or securities anywhere
- Start an ACH or a wire
- See your broker password
- Move anything between your own accounts
Data in transit
Every public endpoint enforces TLS 1.2 or higher. That includes api.nyria.io, app.nyria.io, nyria.io, and docs.nyria.io.
Outbound calls to brokers and exchanges run over the TLS profiles those venues require. Webhook and alert ingestion from TradingView and Discord terminates at our edge over TLS as well.
Data at rest
TLS in transit is done. At-rest credential hardening is still in progress, and the difference matters, so here it is in detail.
Today we rely on database-level access controls and file-level permissions on environment secrets (chmod 600). Database access is restricted by network policy and per-service credentials.
Application-layer at-rest encryption for broker OAuth tokens and API keys is the next hardening step. Until it ships, we do not describe those credentials as encrypted at rest. The privacy policy reflects the same scope.
Infrastructure
Production runs on Hetzner in Germany. The host is a dedicated server, not a shared tenant. SSH is restricted to key auth and protected by fail2ban, which bans IPs that probe credentials.
Postgres has slow-query logging on, which gives us a paper trail for anomalies and a head start on performance regressions. We take daily backups of the production database.
The marketing site, the app, and the docs all sit behind a CDN. The API talks to brokers from a known egress so venues that allow IP allow-listing can do so on request.
Incident response
One contact: contact@nyria.io. Reach out for security reports, suspected account compromise, or anything that looks off.
A person reads that inbox. Material breaches that touch personal data are handled under the breach-notification section of the privacy policy.
Live service health lives on the status page.
No system on the public internet is fully secure. What is described here is what runs in production today, and this page changes when that does.