A firm choosing a trading platform rarely gets a straight answer on security until it asks a straight question. Vendor marketing pages talk about speed and features; what happens to client data, who can see it, and what a breach would look like usually sit one click deeper, on a legal or trust page, or nowhere at all. This is a list of the questions worth asking MetaQuotes, Spotware, Devexperts and SGHK before signing, built from what each of them actually publishes about itself.
We are SGHK, the company behind eTrader, so we answer our own questions here too, honestly, including where we do not hold a certification the question implies.
Why this is a checklist, not a scorecard
Most platform vendors do not publish a full security audit for public download, and several hold no independent security certification they advertise on their own site today. That does not mean their infrastructure is unsafe. It means a firm cannot compare them on a single number the way it might compare uptime or spread. The honest approach is to ask each vendor the same set of questions and judge the answers, rather than assume a feature-rich product is a secure one or a plain page is a weak one.
| Question to ask | Why it matters |
|---|---|
| Who hosts the platform, and where is client data stored? | Determines which country's data protection law applies and who physically controls the servers |
| Does the vendor hold an independent security certification, and when was it last renewed? | A certification from years ago is not the same as one audited this year |
| Is data encrypted in transit and at rest? | Baseline expectation; ask for the specific answer rather than accepting "yes" |
| Who can access client and trading data: the vendor, the firm, or both? | Some platforms are self-hosted by the broker, so the vendor never touches live data; others host it themselves |
| How often is data backed up, and can the firm export it on demand? | Decides how much history a firm keeps if it ever changes vendor |
| What is the vendor's stated incident response time? | A published number is more useful than a promise made on a sales call |
What to ask MetaQuotes about MetaTrader 4 and MetaTrader 5
MetaQuotes states on its own site that it does not operate as a software-as-a-service provider and has no access to a broker's servers, accounts or trading data once a MetaTrader 4 or MetaTrader 5 licence is set up: the broker hosts its own server, and data security and client privacy stay under the broker's control. That is an important distinction to press on in a demo. It means MetaQuotes is not the party to ask about hosting, encryption at rest or backup frequency for your specific clients: your broker's own server operator is, because MetaTrader is typically self-hosted or hosted through a bridge and data-centre provider the broker chooses.
Questions worth asking a MetaTrader server provider or your own IT team, since MetaQuotes will point you there: where is the server physically located, who has administrative access to it, how often is it backed up, and what happens to that data if the server contract ends.
What to ask Spotware about cTrader
Spotware's own site describes cTrader Server as hosted on infrastructure in Equinix data centres, with a proxy layer intended to protect against unauthorised connections and denial-of-service attacks, SSL encryption on network traffic, and each broker's deployment kept in its own segregated environment. Spotware's own news page also states that it attained ISO 27001 certification, following independent assessments completed in 2012, alongside an ISAE 3402 report from Deloitte covering the same year. That is a real, self-published claim, and also an old one: ask Spotware directly whether that certification has been maintained and re-audited since, and ask for the current scope rather than relying on the original announcement.
Also worth asking: whether client trading data sits on shared infrastructure with other brokers on the same cTrader Server deployment, and what Spotware's own data retention and export policy looks like today.
What to ask Devexperts about DXtrade
Devexperts markets DXtrade as a platform hosted for the broker, with 24/7 maintenance and support listed as part of the package on its own product pages. Its public marketing pages do not lay out specific encryption standards, data centre locations or a named security certification the way Spotware's server page does. That is not evidence of a weaker setup, only that the detail is not on the page a firm reads first. Ask Devexperts directly for its data processing agreement, where DXtrade client data is hosted, and whether the platform has been through an independent security audit it can share.
What to ask about TradeLocker, Match-Trader and TradingView
TradeLocker and Match-Trader are typically offered as hosted, white-label packages, which puts the hosting question back on the vendor rather than the broker, the reverse of the usual MetaTrader setup. Ask each one directly where client and trading data live, who can see it, and what happens to it if the firm switches vendors. TradingView sits outside this comparison in a different way: it is a charting layer most brokers connect to rather than the system holding trading accounts, so the sensitive question for TradingView integrations is usually what data, if any, passes to it, not how it stores trading balances.
What we can say about eTrader and SGHK, honestly
eTrader is hosted in the cloud by SGHK and managed by your firm, built to scale across clustered servers as you grow. Everything is encrypted, and your firm is the only one with access to its data and its clients' data. Data is hosted in the EU with hourly backups you can export at any time, and support responds 24/7 on WhatsApp, calls and email. We do not hold a formal certification such as ISO 27001 today, and we say that plainly rather than let the question go unanswered: if a specific certification is a requirement for your licence or your own risk committee, ask us directly where we stand on it before you sign, the same way you would ask any vendor on this list.
What we can commit to in writing: EU hosting, hourly backups, encryption of stored and transmitted data, and a firm-only access model where no other firm on eTrader can see your clients or their data. Those are the same terms we would want from a vendor if we were the ones buying.
Building the question list into your due diligence
Put the six questions above into whatever demo or vendor call you already run, and write down the exact wording of each answer, not a summary of it. "We take security seriously" is not an answer. "Data is encrypted at rest with AES-256 and in transit with TLS 1.3, hosted in an EU data centre with hourly backups" is. If a vendor cannot answer with that level of detail on the spot, ask them to follow up in writing before you commit, and treat a vendor that never follows up as an answer in itself.
For firms weighing this alongside platform features and pricing, run the security questions in the same call as the demo. Book an eTrader demo and ask us the same six questions you would ask anyone else.
"We would rather tell a firm exactly what we do and do not hold than let a security question go unanswered. Ask us, and ask everyone else on your shortlist the same six questions."
— The SGHK Team
Key Takeaways
- MetaQuotes states it has no access to a broker's server, accounts or data once MetaTrader is set up: hosting and data security questions for MetaTrader usually go to your own server provider, not MetaQuotes.
- Spotware publishes specifics on cTrader Server's data centres, SSL encryption and DDoS protection, and states it attained ISO 27001 certification following a 2012 audit; ask whether that certification has been renewed since.
- Devexperts' public pages do not detail DXtrade's encryption or data centre setup; ask directly rather than assume either way.
- eTrader is encrypted, EU hosted, backed up hourly and visible only to your firm; we hold no formal security certification today and say so directly.
Frequently Asked Questions
Does MetaQuotes certify the security of every MetaTrader broker server?
No. MetaQuotes states it does not provide a hosted service and has no access to a broker's server, accounts or trading data once MetaTrader 4 or MetaTrader 5 is licensed. Security and data protection on that server are the broker's own responsibility, so ask your server or data-centre provider the hosting and encryption questions directly.
Is cTrader ISO 27001 certified?
Spotware's own site states it attained ISO 27001 certification after independent assessments completed in 2012, alongside an ISAE 3402 report from Deloitte the same year. Because that announcement is more than a decade old, ask Spotware directly whether the certification has been maintained and re-audited since, and for the current scope of the audit.
Does eTrader hold a security certification like ISO 27001 or SOC 2?
SGHK does not advertise one. What we do state clearly: everything on eTrader is encrypted, your firm is the only one with access to its data and its clients' data, data is hosted in the EU with hourly backups you can export at any time, and support is available 24/7. If a specific certification is a requirement for your own licence, ask us directly where we stand before signing.
What should we ask a vendor that does not publish security details on its website?
Ask directly for a data processing agreement, the physical location of hosting, whether data is encrypted at rest and in transit with the specific standard named, backup frequency, and whether the vendor has been through any independent security audit it can share. Treat a vague or delayed answer as information in itself.
About SGHK
SGHK is a FinTech company that designs and builds its own software for the trading industry: the eTrader trading platform, Launch your Broker and Launch your Prop Firm. Every product is written, hosted and supported in-house and licensed to trading firms, with the CRMs branded to them, all hosted by us in the cloud, managed by each firm and built to scale across clustered servers as our clients grow. Everything is encrypted, and each firm is the only one with access to its data and its clients' data.