Before you connect a tool

Educational checklist. Not legal, investment or security advice. Updated Oct 22, 2026.

Many trading tools ask to connect to your brokerage or exchange. A few minutes of checking can prevent most problems.

1. Look up the company in official databases

• FINRA BrokerCheck: US brokerage firms and brokers, including disciplinary history.
• SEC Investment Adviser Public Disclosure (IAPD): registered investment advisers.
• NFA BASIC: futures and forex firms and individuals registered with the CFTC, with regulatory actions.
• CFTC RED List: foreign firms that appear to need CFTC registration but are not registered.
• NASAA: contact your state securities regulator: state-level registrations and complaints.
• Investor.gov: the SEC's investor education site.

Software that only reads your trade history usually does not need to be registered. A firm that holds your money, executes your orders or gives personalized advice usually does. Outside the US, check your own country's regulator.

2. API key hygiene (crypto exchanges and brokers)

• Never enable withdrawal permission on a key you give to a third-party tool.
• Use read-only keys whenever the tool only needs to read data, such as journals and portfolio trackers.
• Turn on an IP allowlist if the exchange offers one and the tool publishes its IP addresses.
• Create one key per tool, so you can revoke one without breaking the others.
• Revoke keys you no longer use, and review the list of active keys regularly.
• Keep keys out of email, chat, screenshots and shared documents.
• Turn on two-factor authentication on the exchange or broker and on the tool itself.

3. Phishing basics

• Type the tool's address yourself or use a saved bookmark. Don't sign in from links in emails, DMs or ads.
• Be suspicious of urgency: "your account will be closed", "verify your API key now", "claim your bonus".
• No legitimate support team needs your password, 2FA codes, seed phrase or full API secret.
• Check the sender's domain carefully. Lookalike domains are common.
• If a tool reports a breach, rotate your API keys and password straight away.

4. Check our notes

Every tool page shows how the tool touches your money and any incidents we found from credible sources. See how we review tools.