Architecture
How it is built
The parts of RayTrading that decide anything are deterministic, server-side and auditable. The parts that interpret are separated from them by design.
Point-in-time data
Historical analysis may only use information that was knowable at the time. A price revised last week cannot be used to judge a decision made last month. This is the difference between testing a method and flattering it.
Provider-neutral market data
Market data is consumed through an adapter layer rather than wired to one vendor. Providers are qualified on their own merits and can be replaced without touching analysis. No vendor is promoted here as a production source until that qualification is complete.
Deterministic feature engine
Features are computed the same way every time, from the same inputs, with the same result. A number that cannot be reproduced cannot be audited.
AI as an analysis component
AI contributes to analysis. It does not decide risk, it does not size positions, and it does not touch execution. Those are deterministic, server-side and separately testable — which is what keeps a model's confidence from becoming an account's exposure.
Risk engine
Account decisions are made by a deterministic engine against your account's actual state, on the server, and recorded so the reason for a decision survives the decision.
Broker adapter architecture
Broker connectivity is an adapter boundary. The architecture supports multiple venues; what is available today is described on this site as availability, never as architecture.
Realtime product updates
The platform tells a client that something changed. The client then asks the API what is true now. Nothing a user acts on is ever believed from a push.
Auditable by construction
Decisions are written as append-only records. A record that can be edited to look better is not a record.
Trust
What protects an account here
Short-lived sessions
Access tokens are minutes-long and refresh tokens rotate; reuse of a spent token invalidates the family.
Multi-factor authentication
Time-based codes with replay protection and single-use recovery codes.
Credentials the browser cannot read
Session credentials live in httpOnly cookies. A script in the page cannot take them elsewhere.
Encrypted storage on mobile
The mobile application keeps credentials in the platform keychain, device-only.
Tenant isolation
Every read and write is scoped to a workspace and re-authorised on the server.
Server-authoritative decisions
Risk and sizing are computed server-side. A client cannot argue its way to a larger position.
Audit architecture
Security-relevant events are appended, never rewritten.
Protected origin
Traffic reaches the platform through a hardened edge over HTTPS only.
This page describes principles. It deliberately omits operational detail that would help somebody attack the platform.