Your money and your data at Ballad Markets: what we do, what we don’t, and what we can’t promise yet
No custody, encrypted keys with no withdrawal permission, recorded consents, and a list of what we still lack.
By Rafael Acevedo, founder of Ballad Markets · October 2026
When a financial platform asks for your trust, it usually shows you badges and absolute claims. We would rather do something else: tell you what we do, what we don’t do, and what we can’t promise yet. Every statement in this article can be checked against our Trust Center, where each practice carries its real status, including the ones that aren’t finished.
We never hold your money
Ballad Markets is analysis and education software. It is not a broker, an exchange, a custodian or a registered investment adviser. We don’t accept deposits and we don’t hold client funds. Subscriptions are processed by Stripe, and your card details never pass through our servers.
Your API keys, encrypted and with no withdrawal permission
If you connect an exchange or broker account, your API key is encrypted with AES-256-GCM before it is stored, and it is only decrypted in memory at the moment it is used. It is never written to logs and never returned to the browser.
A key with withdrawal permission is rejected when validated. If we can’t verify that it lacks that permission, it is rejected too: when in doubt, the answer is no. So even if someone obtained one of those keys, they couldn’t take money out of your account with it.
Your data, isolated by account
The database applies row-level security on all of its tables: 172 out of 172 on the day we wrote this. Each account can only read its own records, and that rule is enforced by the database itself, not just the screen. Sessions are validated on the server on every protected route, and sign-in and checkout are rate limited.
The whole site runs on HTTPS with HSTS preload, a content security policy and hardened headers. Every code change is scanned for leaked credentials. And if you find a flaw, we publish how to report it and a security.txt file under the RFC 9116 standard.
Your consent is on record, and you can see it
Before you start, and again before you turn on any tool that sends orders to your account, we show you a full notice. If you accept it, we store the document, its version, a fingerprint of the exact text, the language, the date and the time. That record is append-only: the database rejects any attempt to edit or delete it.
You can check it at any time in Control Center → My consents. If the text changes, we ask you again. If you close your account, your personal data is deleted within 30 days, except what the law requires us to keep and this record, which is kept as evidence of your decision.
You set the limits
DELIA, our execution engine, runs on fixed rules. From the control center you can turn it off and set a maximum position size, a maximum daily loss, and how many rejected orders in a row you accept before it turns itself off.
Cognitive AI proposes; rules decide
Part of our content is generated by cognitive AI, and AI can make mistakes. That’s why no model output sends an order unless it passes fixed rules the model cannot change. Our systems are registered, and every desk report is stored with the version that produced it. And what is simulated is called simulated: CHESKO 2.0 results are simulated results.
What we don’t have yet
This part matters as much as the rest:
- We are not certified. We document our practices in alignment with ISO/IEC 27001, ISO/IEC 42001 and ISO 9001, but no accredited body has audited us. Aligned is not certified.
- We have not passed an independent penetration test. Until we do, we won’t describe the platform as audited.
- We have no recorded backup restoration test.
- Two-factor authentication is not available yet for user accounts. In the meantime, use a unique password.
- Our domain is young. That’s why some reputation scanners give us a low score: they weigh domain age and traffic. We’d rather tell you than have you find out.
No system is invulnerable, and anyone who says otherwise isn’t telling you the truth.
Who is behind it
Ballad Markets is a product of CRYPTOLABPR LLC, a company registered in Puerto Rico under registry number 450019-111, which you can verify in a public record.
Ballad Markets is an information and education platform. Nothing it publishes is financial, tax or legal advice, or a personalised recommendation. Investing carries risk, including the loss of all your capital. Past results, real or simulated, do not guarantee future results.
What else would you want to check before trusting a financial platform?