FIG 3.0 · SECURITY MODEL
The guardrails are the product.
Every protective feature on this page is enforced on the server. None of them live in your browser, none of them can be bypassed by a power user, and none of them can be turned off by accident.
POSTURE
Drumlin is software the user configures and runs through their own brokerage account. Drumlin is not a registered investment adviser, dealer, or portfolio manager.
01
30-day paper-trade gate
Server-enforced. Per strategy. Non-skippable.
Every strategy runs against live broker quotes for 30 calendar days before it is allowed to send a single real order. The gate timer lives on our servers, not in your browser. You cannot click past it, you cannot skip it, and a power-user override does not exist.
gate_duration_days = 30 min_paper_trade_count = 12 enforced_at = "server" skippable = false
02
Daily CAD loss cap
Hard limit. In Canadian dollars. No exceptions.
Set a daily CAD loss cap at the account level. When realized losses cross it, Drumlin cancels working orders, blocks new entries until midnight Eastern, and emails you a one-line summary. The cap evaluates in CAD even when the underlying position is in USD.
cap_currency = "CAD" evaluation = "realized_loss" breach_action = "cancel_and_block" reset_at_et = "00:00"
03
One-click kill switch
Cancels everything. 15-minute cooldown.
One button cancels every working order across every strategy and locks new entries until you explicitly re-arm. Re-arming has a 15-minute cooldown so a panicked tap cannot become a panicked untap. The switch is per account; we do not centralize it.
scope = "per-account" action = "cancel_all_working_orders" rearm_cooldown_minutes = 15 audit_logged = true
04
Broker-of-record routing
No Drumlin-held funds. No Drumlin-held securities.
Orders execute through your own Questrade or Interactive Brokers Canada account using your OAuth credentials. Drumlin never custodies cash or securities. We are not a registered dealer or adviser; we are a software tool you configure to act inside your existing brokerage.
custody_model = "broker-of-record" drumlin_holds_funds = false credential_storage = "vault" regulatory_posture = "software-tool"
FIG 3.1 · ORDER FLOW
Nothing reaches the broker until the gate clears.
For paper-mode strategies the live dispatcher is unreachable. The strategy engine writes simulated fills to a shadow ledger using live quote streams from your broker, so you see how a strategy behaves on real data without real exposure.
Credential storage
Broker tokens are encrypted at rest in our Supabase vault and never returned to the client. Token refresh happens server-side; the browser never sees a Questrade or IBKR access token.
Row-level isolation
Every table that holds account data is gated by row-level security. A user can only read and write rows they own. There is no admin role that can place trades on a customer account.
Audit log
Strategy edits, gate state changes, kill-switch toggles, and cap breaches are appended to an immutable audit log per account. You can export it any time as part of the trade journal CSV.