Your money stays with your broker
QuantPower never holds client funds. Your capital, positions and holdings stay in your account with your SEBI-registered broker. Broker trading APIs place and manage orders; they do not move money out. Money leaves a trading account only for the bank account registered with your broker, and only when you ask your broker for a withdrawal.
How the broker login works
- You choose your broker in QuantPower and are taken to the broker's own login page.
- You log in there with your client ID, password and two-factor code. QuantPower never sees the password or the code.
- The broker returns a session token that lets QuantPower read your account and place orders for that day.
- The token expires before the next trading day, as SEBI's framework requires, so you log in again each morning.
Our guide to security algo trading explains in more detail what a broker connection allows and what it does not.
API keys and tokens
Under SEBI's framework, each trader uses a unique API key from their broker, together with a static IP registered with that broker. The API key identifies your account to the broker's API, and the daily token comes from your two-factor login. Neither can move money out of your account.
For your own strategies, QuantPower runs on your own computer or VPS, so your API key and tokens are kept there and stay with you. Keep that computer or VPS secure: use a strong login password, keep it updated and do not share access to it.
Treat your API key and secret like a password. Do not post them in groups, screenshots or emails, and regenerate them in your broker account if you think they have leaked.
Encryption in transit
Your browser or the app connects to QuantPower over HTTPS, and broker APIs are reached over HTTPS too. Data moving between them is encrypted, so others on the same network cannot read it. Check that the address bar shows quantpower.tech before you log in.
Access controls
- Your account only. Your strategies, settings and order history belong to your account and are not visible to other users.
- Limited use. QuantPower uses the data your broker's API provides, such as funds, positions and orders, only to run and report on your strategies. It does not sell your data.
- Staff access. Staff access to account data is limited to what is needed to run the service and help you.
- Service providers. The outside services that help run QuantPower, such as hosting, are listed on the subprocessors page.
What QuantPower never asks for
- Your broker password, PIN or two-factor code
- Your CDSL or NSDL TPIN, or the OTP that authorises selling your shares
- Your card PIN, UPI PIN or net banking password
- Money for trading: your trading capital stays with your broker, and QuantPower takes no deposits
If anyone asks for these in QuantPower's name, it is not us. Do not share anything, and report it to info@quantpower.tech.
What you can do
Good QuantPower security also depends on a few habits of yours:
- Use unique passwords for QuantPower and for your broker, and an authenticator app for two-factor codes.
- Install from Google Play only (com.quantpower), and log in only at quantpower.tech.
- Secure your trading machine. If you run a computer or VPS with your static IP, keep it updated and protected by a strong password.
- Review connected apps and API keys in your broker account every month, and remove any you do not use.
- Set loss limits. A stop loss and a daily MTM limit cap the damage a faulty rule can do.
Reporting a security problem
If you find a security weakness in QuantPower, email info@quantpower.tech with the details and the steps to reproduce it. Please do not access other users' data while testing, and give us reasonable time to fix the problem before making it public.
Related guides
- SEBI compliance: how SEBI's algo rules apply to QuantPower
- Broker connection requirements: API key, static IP and daily login for each broker
- Login and password help: fixing problems with your QuantPower login
- Privacy policy: how QuantPower handles personal data
- QuantPower status: check whether the service is running
Start your free trial
Connect your broker, build a strategy and test it on paper before a single live order goes out.
Frequently asked questions
Will QuantPower ever ask for my OTP or broker password?
No. You enter them only on your broker's own login page. If anyone asks for them in QuantPower's name, do not share them, and report it to info@quantpower.tech.
How do I disconnect QuantPower from my broker account?
Revoke or regenerate the API key in your broker account. Without a valid key and session, QuantPower cannot place orders for you, and every session ends on its own before the next trading day.
Does QuantPower share my data?
QuantPower uses your broker data to run your strategies and does not sell it. The privacy policy and the subprocessors page set out who processes data and why.
What should I do if I see an order I did not place?
Pause your strategies, check the order in your broker's order book and call your broker straight away. If none of your strategies placed it, regenerate your API key, change your broker password and tell QuantPower at info@quantpower.tech.
Is my connection to QuantPower encrypted?
Yes. The web platform and the app connect over HTTPS, so data in transit is encrypted. Check that the address is quantpower.tech before you log in.
Sources
- SEBI: circular on safer participation of retail investors in algorithmic trading, 4 February 2025 (unique API keys, static IPs, two-factor login and daily logout) (checked 20 October 2026)
- NSE: implementation standards for retail algo trading, 5 May 2025 (OAuth login with two-factor authentication, and daily logout of API sessions) (checked 20 October 2026)