Security & Compliance
Alpha Ladder's security posture, data handling practices, and the safety model around destructive financial operations.
This page summarises Alpha Ladder's security posture and the principles governing how the platform handles sensitive data, cryptographic credentials, and high-risk financial operations.
API key security
A Alpha Ladder API key (sk-…) grants full access to the authenticated user's account. Treat it with the same care as a password.
Best practices:
- Do not commit API keys to source control. Use environment variables or a secrets manager.
- Do not share keys in documents, chat messages, or logs.
- Issue one key per integration; rotate keys when team members leave or an integration is decommissioned.
- Delete a key immediately from the API Keys section of the Alpha Ladder dashboard if you suspect it has been exposed. A replacement key can be generated with no downtime.
Alpha Ladder's hosted MCP endpoint (https://www.alphaladder.hk/mcp) transmits all requests over TLS. API keys are never logged by the Alpha Ladder server in a recoverable form.
Authentication architecture
Alpha Ladder's MCP server supports two authentication paths:
| Path | Used by | Mechanism |
|---|---|---|
| OAuth 2.0 + PKCE | Claude.ai, Cursor, Windsurf, Cline | Short-lived access tokens (1 hour); refresh tokens (30 days). Tokens are managed entirely by the client — you never handle them directly. |
| Direct Bearer token | Claude Code, Claude Desktop | API key sent as Authorization: Bearer … on each request. No expiry; valid until revoked. |
Neither path requires storing the raw API key in the client application after initial registration. For the direct Bearer path, the key is stored in the client's MCP server configuration; restrict access to that configuration file appropriately.
See Authentication for the full technical description.
Destructive operations require explicit user confirmation
Financial operations that are irreversible — withdrawals, OTC trade confirmation, FIP subscriptions and redemptions — are treated as explicitly user-initiated actions. Alpha Ladder's MCP tools do not auto-confirm, auto-retry, or chain destructive operations without user input.
The following tools must only be called after the user has reviewed and explicitly approved the action:
execute_fiat_withdrawalconfirm_otc_tradesubscribe_fipredeem_fip
If a destructive tool returns an error, the correct response is to surface the error to the user and wait for re-confirmation — not to retry silently. See Status & Errors for error shapes and Rate Limits for the no-auto-retry policy.
Data handling
Alpha Ladder processes the minimum data necessary to fulfil each request. For AgentX operations, account and transaction data is handled in accordance with Alpha Ladder's privacy policy and applicable financial regulations in the jurisdictions in which Alpha Ladder operates.
Alpha Ladder does not make specific claims about certifications (such as SOC 2 or ISO 27001) in this document. For current compliance status, certification scope, and data residency details, contact the Alpha Ladder team through the channels listed on the Support page.
Responsible disclosure
If you discover a security vulnerability in Alpha Ladder's platform or API, please report it responsibly via the contact channels on the Support page rather than disclosing it publicly. Include a clear description of the issue, steps to reproduce, and potential impact.