Terminal Security & Device Binding: Your Signals, Your Terminal Only

When trading signals are worth real money, security is not a feature -- it is a requirement. A single intercepted signal or unauthorized connection could mean unintended trades and real losses. This is why QuantLink implements security at every layer of the signal relay pipeline.

Here is a breakdown of the mechanisms that keep your signals safe.

Device Fingerprint Binding

The first time a terminal connects to QuantLink, the platform captures a device fingerprint and binds it to that terminal's authentication token. From that point on, only the bound device can pull signals.

If a different device attempts to connect using the same token, the request is rejected with a 403 DEVICE_TAKEN_OVER error. This prevents signal theft even if the token itself is compromised -- the attacker would also need to replicate the original device's fingerprint.

This "last connector wins" model means the legitimate device always retains access, and any imposter is immediately blocked.

Unique Bearer Token Authentication

Every terminal is issued a unique Bearer Token upon registration. This token is required for all terminal-to-platform communication:

• Signal Pull (GET /api/terminals/pull) -- the terminal polls for new signals
• Signal Acknowledgment (POST /api/terminals/ack) -- the terminal confirms receipt
• Execution Reporting (POST /api/terminals/execution) -- the terminal reports trade execution details
• Heartbeat (POST /api/terminals/heartbeat) -- the terminal confirms it is still active

No token, no access. Tokens are generated server-side and never transmitted in plain text.

Heartbeat Monitoring

Active terminals send periodic heartbeats to QuantLink. If a terminal misses its heartbeat window, the platform automatically marks it as offline. This serves two purposes:

1. Visibility -- strategy owners can see which terminals are currently connected and which have gone silent.
2. Security -- a terminal that suddenly stops sending heartbeats may indicate tampering or a connectivity issue that warrants investigation.

Device Takeover Protocol

Sometimes a legitimate user needs to switch devices -- for example, migrating from one server to another. QuantLink handles this through an explicit rebind mechanism. The heartbeat endpoint supports a rebind=true parameter, which explicitly authorizes the new device and revokes the old binding.

Without this explicit authorization, no device can take over a terminal's connection. The rebind action is intentional and deliberate, not accidental.

SHA-256 Payload Deduplication

Replay attacks -- where an attacker retransmits a previously captured signal -- are a real threat in signal relay systems. QuantLink mitigates this using SHA-256 payload hashing.

When a signal arrives from JoinQuant, QuantLink computes a SHA-256 hash of the raw payload and checks it against the rawSignal table. If the hash already exists, the signal is silently discarded as a duplicate. This ensures that every signal is processed exactly once, regardless of how many times it is transmitted.

HTTPS Encryption

All communication between JoinQuant, QuantLink, and QMT/PTrade terminals is encrypted via HTTPS (TLS). Signal payloads, authentication tokens, and device fingerprints are never transmitted in plain text. This protects against man-in-the-middle attacks on any network.

Clear Boundary: No Fund Custody

It is worth stating explicitly: QuantLink never accesses your trading accounts and never holds your funds. The platform's role is strictly limited to signal relay:

• QuantLink receives signals from JoinQuant
• QuantLink delivers those signals to your authorized terminals
• Your QMT or PTrade terminal executes the trades locally on your machine

Your broker credentials, trading accounts, and capital remain entirely under your control. QuantLink is a messenger, not a custodian.

The Security Stack at a Glance

QuantLink's security model is designed so that even if one layer is compromised, the remaining layers continue to protect your signals. Defense in depth, applied to quantitative trading.