Security and access controls

1. Role-based access

Every staff user is assigned a role. Roles determine which modules a user can open and which actions they can take — for example, finance can process payment requests while support can view client records without approving withdrawals. Sensitive actions such as withdrawal approval, IB rate changes and permission changes can be limited to named roles.

Manager seats are available according to your plan: up to 12 on Standard and unlimited on Unlimited.

2. Audit logs

Administrative actions — KYC decisions, payment approvals, account creation and permission changes — are recorded in an activity feed and audit trail with the user and time, so your team can see who did what and when.

3. Infrastructure and API protection

Data travelling between browsers, the back office and our services is transmitted over encrypted HTTPS connections. REST & Client API requests require authenticated credentials issued to your systems, and those credentials can be rotated or revoked.

4. Credential handling

MT5 manager credentials, payment-provider keys and KYC-provider keys are stored and used on the server side. They are never sent to browsers or embedded in front-end code. We recommend a dedicated MT5 manager login for the bridge, with only the permissions it needs. See the Open API Bridge for details.

5. Data separation

Each brokerage's client records, KYC files, transaction ledgers and partner configuration are kept separate from other brokerages' data, and access is limited to that brokerage's authorised users and our support staff working on its behalf.

6. Maintenance and updates

We maintain the platform and its components, apply security fixes as part of ongoing support, and schedule updates to minimise disruption to live operations. Planned maintenance may involve short periods of reduced availability, as described in our terms.

7. Shared responsibility

Security is shared between DARKLIGHT FX and your brokerage. Your team is responsible for:

• Assigning roles appropriately and removing access when staff leave
• Keeping staff passwords private and secure
• Protecting API credentials issued to your systems
• Securing your MT5 server, payment-provider and KYC-provider accounts
• Meeting the regulatory and data-protection obligations that apply to your licence

8. Reporting a security issue

If you believe you have found a security vulnerability in a DARKLIGHT FX service, please email support@thedarklightfx.com with "Security report" in the subject line and enough detail for us to reproduce it. Please don't access other users' data or disrupt services while testing.