Broker Connections

1. How StockGitter connects

StockGitter connects to two brokers, both in private testing: Robinhood, as an MCP (Model Context Protocol) client of Robinhood's Trading MCP server, and Tradier, through Tradier's REST API. Tradier is live for testing.

Each user connects their own account. After reading a consent screen in StockGitter, the user signs in on the broker's own website using OAuth with PKCE. The broker then returns a one-time code to StockGitter's server, which exchanges it for access tokens.

For Tradier, each user connects their own account with their Tradier API access token. After the consent screen, the user pastes the token into a secure form on the Trading Desk and picks live or sandbox. StockGitter checks it with one read call, lists the user's accounts, and the user picks the account the Desk uses. The token is then encrypted and stored for that user only. It is never shown again, never logged, and never sent back to the browser.

StockGitter never sees or stores your broker password.

2. What we read

StockGitter reads only what it needs to show you your own Trading Desk:

• → Your accounts (shown as the last 4 digits only) and balances
• → Stock quotes and intraday price bars
• → Option chains with live prices and greeks
• → Your option positions
• → Your option orders and fills
• → Your realized profit and loss
• → The earnings calendar
• → A preview of the broker's market scanner, to find stocks moving today (nothing is saved in your broker account)

This data is used only to show that same user their own prices, positions, trade journal, profit and loss, and risk limits (daily and weekly loss limits, position size, and similar checks the user sets for themselves).

3. What we never do

StockGitter never:

• → Places, cancels, changes or reviews an order
• → Exercises an option
• → Moves money or makes transfers
• → Creates or edits watchlists, alerts or saved scans in your broker account

Robinhood's only available permission for its Trading MCP server also allows trading in the dedicated MCP (agentic) account and editing watchlists. Robinhood's sign-in page lists these, and the permission cannot be narrowed when connecting. StockGitter does not use them.

Tradier's access token also allows trading. StockGitter does not use that either: only GET requests to a fixed list of read-only Tradier endpoints (quotes, option chains, price history, the market clock and calendar, and the account's positions, orders, balances and gain or loss) can be sent. Every order, cancel, modify or account-changing request is refused before it is sent.

StockGitter enforces this in its own code. Only a fixed list of read tools can be called. Every other tool, including any tool whose name places, cancels, replaces, reviews, exercises, transfers, creates, updates, deletes, adds or removes anything, is refused before any request is sent to the broker. A bad edit to the list still cannot allow a write tool.

Automated tests enforce this. They try every write tool the broker offers and check that none of them reaches the broker, and they check that every tool the code calls is on the read-only list.

Users place their own orders in their broker's app. StockGitter can show a read-only order summary for the user to copy, nothing more.

4. One user, one account

Each user's broker data is used only for that user. It is never shown to, shared with or used for any other user, and it is never sold.

Broker data is cached only in a cache tied to that one user. It is never placed in the shared market data caches that serve all users, and automated tests check both.

Results from a user's broker scanner are used only for that user's own list. Other users get their list from general market data.

5. Security

• → Access tokens (Robinhood's and Tradier's) are encrypted at rest with AES-256-GCM, using a key held only in the server environment. Each user's tokens are bound to that user, so a copied record cannot be decrypted for anyone else.
• → Tokens are stored in a server-only database table. No signed-in user, including the token's owner, can read it directly.
• → Broker account numbers are kept only inside that encrypted record. Everywhere else, accounts appear as the last 4 digits.
• → Every broker request is made from StockGitter's server after checking the user's session. Nothing about the broker connection runs in the browser.
• → Call logs record the tool name, whether it succeeded, the time and how long it took. They never record request details, responses or account data.

6. AI summaries

Written summaries on the Trading Desk (daily briefs and recaps) are written by SAGE, which is built on Anthropic's Claude, used through Anthropic's API.

SAGE receives only figures prepared from the signed-in user's own data and general market data, only to write that user's own summaries. It never receives broker account numbers or the user's name. Every number in a summary is checked against the figures StockGitter computed before the summary is saved.

7. Your control and data retention

You can disconnect at any time:

• → In StockGitter: Investments, then Desk, then Brokerage account, then Disconnect. Your tokens are deleted immediately and your cached broker data is cleared.
• → In your broker's app: Robinhood lets you revoke access from its Security and Privacy settings. StockGitter then stops receiving data and shows that the connection has ended.
• → Tradier: you can also revoke the token in Tradier (Settings, then API Access). StockGitter then stops receiving data and shows that the connection has ended.

What is kept, and for how long

• → Tokens: until you disconnect or delete your StockGitter account. Disconnecting deletes them immediately.
• → Connection record: the broker's name, your accounts shown as the last 4 digits, and the dates you connected and disconnected stay in your account after you disconnect, so you can see the history.
• → Call log: tool names and times, kept with your account.
• → Fills: copied into your own trade journal, where they stay as part of your trading history.
• → Balances: each connected account's value after the close, and the transfers your broker reports, are saved to your Capital management history so sizing and the sweep can use them. Nothing else is stored.
• → Cached broker data: held in server memory for between a few seconds and an hour, then discarded. It is cleared at once when you disconnect.
• → When you delete your StockGitter account, your broker tokens, connection records and call log are deleted.

8. Current status

Broker connections are in private testing with a small number of users. They are not yet available to all StockGitter users. Tradier is live for testing and available to Trading Desk users; Robinhood's sign-in is being completed with Robinhood.

For questions about this page, see our Privacy Policy for how to contact us.