Legal & policies

TMR Terminal — The Market Revelation

This page describes, in general terms, how we protect TMR Terminal and your data, what you need to do on your side, and how to tell us about a security problem. We deliberately do not publish technical details that would help someone attack the service.

1. How we protect the service

• Signed updates. Every app update is signed by us and verified by the app before it installs. An update that fails verification, or is older than the installed version, is refused.
• Credentials encrypted at rest. Broker and data-source access is encrypted on our servers, is opened only on the server to carry out your instructions, and is never sent to your browser, written to logs or shown to anyone else. Passwords, PINs and one-time codes used only to sign in to a broker are not stored.
• Your data is yours alone. Data fetched with your credentials is shown only to you.
• Locked-down app. Pages inside the app cannot reach your file system or operating system, the app opens only our own site and our sign-in provider inside its windows, and every other link opens in your normal browser. Local components the app runs on your computer accept connections from your own computer only.
• Accounts and licences. Passwords are stored only as hashes, device identifiers are hashed on your computer, licences are checked by our servers, and seats and computers can be revoked promptly if misuse is suspected.
• Operations. Access to production systems is limited to the people who need it, and we keep logs to detect and investigate misuse. We review and update these measures as the service changes.

No system is perfectly secure. If a breach affecting your personal data occurs, we will notify you and the authorities as the law requires, including the Data Protection Board of India and the Indian Computer Emergency Response Team (CERT-In).

2. What you need to do

• Download TMR Terminal only from themarketrevelation.com, and install updates when the app offers them.
• Use a strong, unique password for your TMR account, and do not share your account.
• Keep Windows and your antivirus up to date, and do not run the app on a computer other people control or can access without your knowledge.
• Prefer each broker's own sign-in page (OAuth) where it is offered, give an API key only the permissions you need (for example, never withdrawal permission), and set an IP restriction on it where your broker allows.
• Keep a sensible maximum order size on live accounts, and disconnect brokers you no longer use.
• We will never ask you for your password, a broker password, a PIN or a one-time code by email, Discord message or phone. Report anyone who does.
• If you think your account or a broker connection has been misused, disconnect the broker in the app, change your passwords, contact your broker, and tell us.

3. Reporting a vulnerability

If you believe you have found a security vulnerability in TMR Terminal, our website or our other services, please tell us at [email protected] with the subject "Security report", or open a private ticket in our Discord server. Please include enough detail for us to reproduce it, and give us a reasonable time to fix it before telling anyone else.

When testing, you must:

• only use accounts you own, and never access, change or delete other users' data or trade on anyone else's account;
• not run denial-of-service, spam or social-engineering attacks, or test physical security;
• not use automated scanning that degrades the service for other users;
• stop and tell us as soon as you reach data that is not yours, and not keep any copy of it.

If you act in good faith and follow these rules, we will not take legal action against you for your research, we will keep you informed while we fix the problem, and, if you wish, we will credit you once it is fixed. We do not currently run a paid bug bounty, and any reward is at our discretion.

Out of scope: reports from automated tools without a demonstrated impact, missing best-practice headers with no security effect, issues that need a compromised computer or physical access, and vulnerabilities in third-party services, which should be reported to their owners.