XFIV security starts with the basics done properly. Access is role-based, API keys are scoped per integration, and every API and MCP request is written to an audit log. AI assistants get read-only, broker-scoped access and cannot place trades. Hosting and data-protection details are shared during your security review.
XFIV products are designed to run on established cloud infrastructure, with our own controls on top and consistent, repeatable deployments. Hosting details are confirmed per project.
Data moving between clients, brokers and XFIV travels over encrypted connections. Encryption of stored data and backups is confirmed during your security review.
Staff, integrations and AI assistants get only the access they need. Roles control what broker staff can see, API keys are scoped per integration, and every request is logged.
Security is a set of habits, not a single feature. These are the practices that apply across XFIV products.
Each integration gets its own key with only the scopes it needs, so one key can be revoked without affecting others.
Webhook payloads from XFIV Connect are signed so your systems can check they came from us and were not changed.
Limits on API usage protect your MT5 server and our platform from runaway or abusive integrations.
A record of who called what, and when, for API calls, MCP requests and staff actions.
Service logs help us detect problems early and investigate incidents with facts, not guesses.
Integrations are built and tested against sample data before they touch production accounts.
We are building towards formal security certifications. Security questionnaires are answered during onboarding.
Until then, we share how XFIV is designed, what we log and how access is controlled, in writing, as part of your security review. Certifications never replace your own due diligence.
Two XFIV features give AI models access to account data: the AI agent in XFIV Portal, and the MCP layer in XFIV Connect, which lets clients connect compatible AI assistants to their accounts. Both follow the same rules.
Access is read-only by default. AI assistants and the agent cannot place, modify or close trades. Data scopes are set by the broker and enforced by XFIV Connect, outside the AI model, so a model cannot talk its way past them. Each request is checked against the signed-in client’s own accounts, and every request is written to the audit log.
The agent gives information, not investment advice. When a question needs a person, it hands the conversation to the broker’s support staff. Brokers decide whether to offer AI features at all, to which clients and on which terms.
With XFIV Connect, your clients can link their trading accounts to AI assistants through the Model Context Protocol. Access is read-only by default, scoped by the broker, and every request is logged for review.
Read the MCP guideAI responses are informational and are not investment advice.
XFIV is a brokerage technology provider, not a broker. Security of a brokerage depends on both of us. This is how responsibilities usually split.
| Area | XFIV | Broker |
|---|---|---|
| Hosting and infrastructure | Runs XFIV products on managed cloud infrastructure | Runs and secures its own MT5 server |
| Encryption | Encrypts data in transit; storage encryption confirmed per project | Secures its own systems that receive XFIV data |
| Access control | Provides roles, scoped API keys and audit logs | Assigns roles to staff and reviews access regularly |
| AI and MCP access | Enforces read-only access and broker-set scopes | Decides which scopes and AI clients to allow |
| Integrations | Signs webhooks and applies rate limits | Verifies webhook signatures and stores keys securely |
| Regulation | Provides software only | Meets its own regulatory and legal obligations |
If you believe you have found a security vulnerability in an XFIV product or website, please email security@xfiv.com. Include a description of the issue, the steps to reproduce it and any relevant details such as affected pages or requests.
Please give us reasonable time to investigate and fix the issue before sharing it publicly. Do not access, change or delete data that does not belong to you, and do not run tests that could disrupt service for brokers or their clients. We will acknowledge your report and keep you informed as we work on it.
The full picture of how AI assistants get scoped, logged access through XFIV Connect.
Read moreThe guardrails around the AI agent in XFIV Portal.
Read moreAPI keys, webhooks and sandbox access for your integration team.
Read moreWho we are and what we build for MT5 brokers.
Read moreHosting details, including region, are confirmed per project and shared during your security review. Sandbox and production are designed to be kept separate.
Data is encrypted in transit. Encryption of stored data and backups is documented for each deployment during your security review.
Not yet. We are building towards formal security certifications. Security questionnaires are answered in writing during onboarding.
No. AI access through XFIV Portal and XFIV Connect is read-only by default, limited to broker-set scopes and logged. AI assistants cannot place trades.
Email security@xfiv.com with a description and steps to reproduce. Please do not disclose the issue publicly until we have had time to fix it.
Book a demo and tell us what your review needs. We will answer questionnaires in writing and walk your team through access control, audit logs and AI safety.
Last reviewed 2026-10-29