DEXA sees every deal on your book — so we built it to protect every one of them.
Read-only access to your platform, a separate database for every broker and no trader personal data by default, all run under an information security management system certified to ISO/IEC 27001:2022.
Security at DEXA isn’t a document written after the fact. It’s how the platform is engineered: each of these is enforced by the system itself, on the server, for every request.
DEXA reads your book through a read-only database connection or your platform’s reporting API. Analytics can’t open, close or modify a single trade.
The only changes DEXA ever makes on your servers are automation actions you configure yourself — through a limited Manager account that you create and control.
Your deals, positions and trader profiles live in an analytics database of their own — physically separate from every other client’s.
On top of that, every request is bound to your workspace on the server side, so nobody outside your team can query your data.
Classification, risk and A/B-book analytics run on trading behaviour alone. DEXA doesn’t need your traders’ names, ID documents, KYC files or bank details — so it doesn’t collect them.
Want names on screen? You switch them on, server by server.
Traffic between your browser and DEXA, and between DEXA and its databases, is protected with TLS.
Your platform logins, passwords and server addresses are stored AES-256 encrypted. User passwords are hashed with bcrypt — never stored or logged in plain text.
Every page can be set to Not allowed, Read only or Full access for each user — and the rule is enforced by the server, not just hidden in the interface.
Two-factor authentication with an authenticator app is built in, and it is mandatory for external dealing teams you invite.
The AI never connects to your database. It can only propose a query — DEXA checks it for safety first and only then runs it on the AI’s behalf:
Your data is never used to train third-party AI models.
Many SaaS platforms keep every client in the same tables and rely on a filter to tell them apart. DEXA gives every broker an analytics database of its own, so your flow never shares storage with anyone else’s — including your competitors’.
Read-only database user or reporting API. You create the credentials and can revoke them at any time.
Pulls deals, positions and balances, then classifies, scores and aggregates them — always scoped to one broker at a time.
DEXA asks only for read access to your platform. Even inside DEXA, AI reports run under a restricted database user with fewer rights than the application itself.
Every API call is bound to your workspace before it reaches a database. A user of one broker has no path to another broker’s data.
Larger brokers can run on their own dedicated database servers and sync workers.
Personal data that the analytics don’t need simply never enters DEXA. Less data stored means less data that could ever be exposed — and a much simpler conversation with your regulator and your DPO.
Trading data — everything the analytics need.
So it isn’t collected in the first place.
Optional, and always your call. Two things are off unless you switch them on: showing trader names (the “Load traders personal data” setting, per trading server) and linking a client’s accounts by email. Switch names off again and they are wiped from DEXA on the next full sync.
For enterprise clients we offer an on-premise deployment. The database with all your broker data and the servers that process it run inside your infrastructure, under your control. The web interface stays on our side, in the DEXA cloud, which keeps only platform-wide settings and the configuration of your DEXA environment.
All your broker data: deals, positions, balances, trader profiles, classifications and reports
Synchronisation, classification, risk monitoring and report generation
Already in your perimeter — your trading data is processed right next to it
General configuration of the DEXA platform
Users, roles, rules and connection settings
The app your team signs in to — hosted and kept up to date by us
Your team keeps signing in to the same DEXA app. When a page opens, its results are fetched from your servers over an encrypted connection to be displayed.
ISO/IEC 27001 is the international standard for information security management. Our certificate means independent auditors have examined how we govern risk, control access, manage suppliers and handle incidents — and that they come back every year to check again.
Valid until 1 July 2029
DEXA is built and operated by the Tools For Brokers group of companies (T4B). The information security management system of T4B Holding Ltd covers our fintech software, trading infrastructure, cloud services and the technical support we provide to you.
“Provision of an Information Security Management System covering governance, risk management and oversight of information security controls for fintech software solutions, liquidity bridge and gateway platforms, trading infrastructure, cloud services, and related technical support activities within T4B Holding LTD.”
Information security risks are identified, assessed and treated formally — not ad hoc.
Every control in the 2022 standard is assessed in our Statement of Applicability.
Surveillance audits in 2027 and 2028, full recertification in 2029.
Incidents, audits and reviews feed back into how we work.
Certification is the floor, not the ceiling. This is how we keep DEXA safe between audits.
Production systems are reachable only by a small group of authorised engineers. Internal operations tools are separate from the broker app and never exposed to clients.
All public traffic passes through a global edge network with built-in DDoS protection before it ever reaches our servers.
Connectors, syncs and databases are health-checked automatically, with alerts routed straight to our engineers.
More than 27,000 automated tests — over 15,000 unit tests and over 11,000 end-to-end checks — must pass before a release reaches production.
A documented incident process. If a security incident ever affects your data, we tell you without undue delay — what happened, what was affected and what we’re doing about it.
Retention periods are applied automatically. If you leave, you get a 30-day window to export, after which your database is deleted.