Skip to main content
A few rules shape the whole product. Each one below says what Itoflow does and what it means when you build on it. For the layers these rules sit in, see How Itoflow works, The agent harness and Quant engine and risk model.

A person approves every live trade

Agents propose trades; they never send live orders on their own. Automatic execution can be switched on for paper portfolios only, and the API refuses it for live ones. An approval covers one exact proposal. The pending-trades response carries a proposal ID and a hash of its contents, and the approval must send both back. If the proposal changed after you reviewed it, even slightly, the approval fails and you review it again. Nobody can approve one set of trades and have another go to the broker. For your code: show the owner the proposal you read, and send that proposal’s ID and hash. See Approve trades.

Your token decides what you can reach

Itoflow takes your identity from your access token, never from the request. An ID in a URL or body is only a label; every request checks that your account owns the resource or that it was shared with you. Where it helps privacy, Itoflow answers 404 for resources you can’t see, so it doesn’t reveal that they exist. For your code: you can’t reach another account’s data by guessing or passing IDs, and you don’t need to send user IDs at all.

Only data that existed at the time

A backtest that uses data from after its own date gives results you can’t trust. Itoflow avoids this:
  • Factor-risk results come from the model snapshot saved on or before the date you ask for. The response’s provenance says if any input, such as sector labels, reflects today’s values instead.
  • A fund’s quarterly SEC holdings filings count from the day the SEC accepted them, not the quarter they describe.
  • A report’s date is fixed when its run starts, and retries keep it.
For your code: use factor-risk covariance in backtests, check its provenance, and store snapshot_as_of with each result.

The engine starts the report; the agent’s analysis finishes it

A fund-oversight report starts from the figures Itoflow’s risk engine computes. The agent decides what matters, explains it, and may correct a figure or add its own from further analysis. When the engine has evidence a figure is wrong, the report leaves out that figure and anything that depends on it, rather than estimating. Missing trading volume is never filled in. Research that builds a research contract also gets an independent review of the plan and the answer. If the review can’t run, or concerns are still open after 10 rounds, the work continues and Itoflow records why. See Independent review.

No silent model changes

Each chat, monitor and strategy saves its own model. A run uses the model saved when it starts, for the agent and its review, through every retry. If your plan stops covering that model, runs stop and ask you to choose; Itoflow never switches model without telling you. If it can’t check your plan, it returns 503 rather than assume you’re on Free. For your code: the results you read were produced by the model you chose. See models and plans.

Safe to retry

Networks drop responses. Where repeating a request could cause harm, Itoflow makes the repeat harmless:
  • Running a monitor report while one is queued joins that run instead of starting a second.
  • Sending a research turn again with the same message_id, message and model_key replays the same turn.
  • Deleting a monitor or chat again confirms the same deletion.
Long work returns an ID you can follow, and 202 means accepted, not finished. Strategy runs are the exception to safe repeats: each request queues a new run. For your code: see API conventions.

Every change is versioned

Each edit to a monitor’s or strategy’s mandate creates a new version and keeps the old one. Reports record the version they ran under, and strategy edits can require the version you last read, so two people can’t overwrite each other’s changes unnoticed.

Money keeps its currency

Holdings, cash and trade amounts carry their own currency, and many amounts are decimal strings rather than floating-point numbers. Itoflow never infers a currency from a ticker or exchange. Credits, which measure AI usage, are kept apart from money. Schedules use a local time and an IANA time zone, so a 09:00 report stays at 09:00 when clocks change.

Credentials stay where they belong

  • MCP: your AI client signs in through OAuth and stores the result. The assistant never sees a token.
  • ChatGPT subscription: the long-lived credential stays outside the agent’s environment. A run gets only a short-lived access token.
  • Remote MCP servers: a token you add is stored encrypted and sent only to that server. Itoflow never passes on your own Itoflow credentials.
  • GitHub: the token never enters the sandbox. A service outside it adds the token to each call after checking that you own the connection.
  • Brokers: broker credentials are stored encrypted and never enter the agent’s environment.
  • These docs: the in-browser request tool sends no cookies and no proxy sits in between. Your request goes straight to the API.

Security and data handling

  • Isolated sandboxes. Agent code runs in an isolated sandbox for each chat. The sandbox holds no database credentials and no tokens, and reaches data only through fixed operations, scoped to the owner, that Itoflow runs outside the sandbox.
  • Least access for GitHub. The GitHub app asks only for code, pull requests and CI results. It gets no access to Actions, workflows, admin settings or secrets. Branch protection still applies, and a merge must name the commit it expects.
  • Outside text is data. Text from your repositories counts as untrusted input, not as instructions to the agent.
  • Remote MCP calls stay narrow. Itoflow reaches your MCP servers over HTTPS on public addresses only, follows no redirects and sends no cookies.
  • No blind repeats. If a write to GitHub or a connected server may or may not have happened, Itoflow reports the outcome as unknown and doesn’t send it again on its own.
  • Encryption. Connections use encrypted transport. Broker and ChatGPT-subscription credentials are encrypted at rest with AES-256-GCM. GitHub and MCP server tokens are held by our identity provider and never enter the sandbox.
  • No customer money. Itoflow is not a broker or custodian and holds no customer funds. Live orders go to your own broker account, and only after a person approves them.
  • Assurance. Our SOC 2 assurance work is in progress. The security overview has the current state.

Further reading