ENGINEERING · READ-ONLY
Read-only is the whole point
Siddani holds API keys that can read but never touch money. That single constraint decides everything else about how the platform works — and why your track record can be trusted.
2026-10-05 · SIDDANI BLOG
Most trading platforms ask for your keys and promise to be careful. Siddani starts one step earlier: the keys you connect cannot move money. Withdrawal and trade permissions are never requested at connect time, so the worst case of a full platform compromise is an attacker reading your track record — not touching your funds.
What we actually hold
An exchange API key with Enable Reading and nothing else. A MetaTerminal EA that streams deal data from your own terminal. Both are sealed with envelope encryption — API keys live inside a vault whose master key is held outside the database, so a leaked database alone opens nothing. Credentials never appear in logs, exports, or the audit chain.Why the product is better for it
Constraints force honesty. Because Siddani cannot trade, every number on the platform must come from fills the venue itself verified — reconstructed round trips, income records, balance snapshots. There is no manual trade entry to fudge, no screenshot of a broker statement to photoshop. Your Analytics view, your calendar, your benchmarks: all of it descends from rows the exchange wrote.The health checks exist because of it
Read-only also means Siddani sees your record exactly as the exchange wrote it — warts included. That is why the automated vetting panel can cross-examine your own numbers: profit-factor bands, sizing-after-loss fingerprints, streak dependency, the gap between closed and floating drawdown. The same checklist that exposes fake signal pages on the internet runs quietly on your own account — flags included, ego excluded.The trust strip. Read-only enforced · no withdrawal permissions ever · no file uploads. That strip appears on every verified public profile and in the account center — it is not marketing copy; it is the architecture, stated as constraints.
What this means for you
You connect in five minutes, you never fear for your funds, and the numbers you read — or publish to a verified profile — carry a provenance no screenshot dashboard can match. That is the whole philosophy in one paragraph, and it is why the platform is built the way it is.Read-only enforced · no withdrawal permissions ever · no file uploads — the trust strip on every verified profile is not marketing; it is the architecture.