Security and boundaries
Safety starts with what the product cannot do.
ThorAlpha separates authenticated research state from public pages and provides no live brokerage, custody, funding, or withdrawal path.
IDENTITY
Google OAuth
Google completes authentication. ThorAlpha does not receive or store the user's Google password.
SESSION
Signed cookies
Short-lived, secure, HttpOnly session cookies protect authenticated routes.
ISOLATION
Per-user portfolios
Each authenticated identity maps to a separate persistent paper portfolio.
BOUNDARY
No live trading
No broker credentials, deposits, custody, transfers, or withdrawals are implemented.
GUARDRAILS
Validated paper orders
Supported products, cash, size, balance, and concentration are checked before simulated execution.
TRANSPARENCY
Product-state labels
Roadmap functionality is labeled and kept distinct from currently available features.