We trade our own capital — and build the systems that do it

Each strategy is defined by declarative parameters and lives as a separate module: cross-venue arbitrage, market-making, grid schemes, and scheduled averaging. A strategy makes a decision and forms an intent, while a separate execution engine handles order submission and management — the trading logic never talks to the exchange directly.

Risk limits are set in each engine's configuration rather than hard-coded: exposure bounds, maximum drawdown, size per level. Before a strategy is given access to real capital, it goes through backtesting and a period of paper trading — this weeds out configurations that only appear to work on historical data.

Each venue differs in precision rules, its set of order types, request rate limits, and its authorization scheme. The adapter reconciles all of this into one interface: prices and sizes are rounded to each instrument's rules, invalid orders are rejected before they are ever sent, and REST, WebSocket, and FIX look identical to the trading layer.

Channel reliability is handled separately. Connections reconnect automatically, the private-stream key is renewed on a schedule, and stream events are deduplicated by identifier and resilient to reordering. The quote feed and the trading channel are separated onto different sockets so that a surge of market data does not delay order submission.

The backtester replays market events in their original order rather than averaged across bars: orders pass through the same execution logic as in production, accounting for fees, spread, slippage, and partial fills. Indicators are computed causally, as of each bar's close, with no centered windows or retroactive smoothing — otherwise the results would be peeking into the future.

Robustness is checked with a walk-forward scheme: parameters are fitted on one segment of history and evaluated on the next, which took no part in the fitting. A configuration that works only on the training window is never allowed near real capital — this is the primary safeguard against overfitting.

Every order is checked against limits before it is sent: per-instrument and aggregate exposure, maximum drawdown, size per level. A breach is not merely logged — it blocks any increase in the position. Limits are defined in configuration and change without editing the trading code, so risk boundaries stay under explicit control.

The kill switch cancels resting orders and halts trading on an operator signal or an invariant violation. Positions are reconciled periodically against the exchange's state; any discrepancy between local accounting and the venue freezes the strategy until it is resolved, rather than trading on an incorrect picture.

Telemetry tracks latencies, fills, positions, and the state of connections to the venues. Every order is recorded in the log together with the reason it was placed — this makes the decisions taken reproducible and allows any trade to be reviewed after the fact without relying on an operator's memory.

Alerts fire on threshold breaches, a dropped data feed, and rising latency between the exchange's matching engine and local receipt. The state of the systems is visible in real time without server access, and the metrics channel and log are separated from the trading path so that diagnostics do not compete for resources with order submission.

Each venue's key is created with a single right — to trade. Withdrawals and transfers are disabled on the exchange side, so even a compromised key cannot move funds off the venue. This is the technical backbone of the principle on which the company is built: trading is conducted exclusively with its own capital.

Secrets are stored apart from the code and trading logic and never appear in logs or error messages. Access to keys is segregated by role and logged, and scheduled rotation is performed without halting trading. Separate keys for different venues and environments limit the blast radius of any leak.