Data custody
Who holds what.
YOUR SERVERS
✓ Remembered broker passwords, only if you opt in (split key)✓ Trading terminals and their data✓ Risk engine and its state✓ Open positions and order flow
CONTROL PLANE
✓ Server list, settings and approved images✓ Users, roles and audit log✓ Health, alerts and metrics✕ Never a readable broker password
The control plane is self-hosted too: it runs on a server you own.
Credential delivery
A password travels once, encrypted, and is gone.
1You enter it onceIn the dashboard, after confirming your own sign-in again.
2Sealed for one serverEncrypted to that server’s agent key. The control plane cannot open it.
3Delivered and usedThe terminal logs in. PerkBridge keeps it in memory only and never logs it.
4DiscardedNo copy is kept, unless you opt in to remember it split between your server and the control plane. PerkBridge never logs in on its own.
Controls
Security controls in the product.
Mutual TLSEach agent enrols with its own certificate. Unknown addresses are refused before the TLS handshake.
Verified onboardingSSH host identity checked; provisioning credentials are temporary.
Trusted imagesOnly approved, version-pinned runtime images from PerkBridge’s own registry can run. Platforms come from a signed catalog.
Least privilegeNo exposed Docker API and no socket access for containers. Operator and viewer permission sets, granted per server or deployment.
Single sign-onOIDC sign-in through a bundled identity provider or your own.
Audit logWho did what and when, for every privileged action and order, including refused access.
Signed releasesIn progressSigning and verification are built. Until the production release key is published, every build is an early-access build.
Host firewallOnly your registered servers can reach the agent gateway. The installer can also lock the port with firewall rules.
External auditNot yetNo independent audit has been done yet. An internal code and security review was done, and its Medium findings are fixed.
Trading safety
Rules the platform never breaks.
Removing a server or environment never closes broker positions.
An unreachable control plane never deletes a running environment.
No blind restarts: a stalled terminal raises an alert and a person decides. Starting again after a server reboot is a setting you control.
Ambiguous order outcomes are reconciled, never resent.