Security Architecture

Every Calamari customer receives a dedicated Windows Server appliance — a Tentacle — provisioned on Contabo bare-metal-class dedicated virtual machines in European data centers. No two customers share an operating system, a trading terminal installation, or any application runtime. Isolation is architectural, not logical.

Each Tentacle runs Windows Server 2022 with a hardened baseline configuration. The Tentacle API service (FastAPI on port 8000) is the sole programmatic entry point to the appliance. All other inbound ports are blocked by default at the Windows Firewall layer.

The Calamari Controller — a hardened Linux orchestrator — communicates with each Tentacle exclusively over encrypted channels. All Tentacle API calls are authenticated with per-appliance API keys and transmitted over TLS. WinRM management traffic uses HTTPS (port 5986) with certificate-pinned connections; the plaintext WinRM port (5985) is blocked.

Windows Firewall rules on each Tentacle are configured to accept inbound connections only from the Controller's IP address on the permitted ports. All other inbound traffic is silently dropped. This means your Tentacle is not reachable from the public internet except through Calamari's authenticated management plane.

• →Port 8000 (Tentacle API): inbound allowed from Controller IP only
• →Port 5986 (WinRM HTTPS): inbound allowed from Controller IP only
• →Port 443 (LiveView/noVNC): inbound allowed, TLS-terminated, session-authenticated
• →Port 5985 (WinRM HTTP): blocked
• →Port 5900 (VNC): blocked externally — loopback only
• →All other inbound ports: blocked by default firewall policy

Calamari does not store your trade data on our servers. All trade execution happens locally on your Tentacle. Your MT4/MT5 terminals connect directly to your broker — Calamari's infrastructure sits between you and your terminal, not between your terminal and your broker.

Broker credentials (account numbers and passwords) are handled with a zero-trust model. Passwords are passed directly to the MT4/MT5 login function in memory and are never written to disk, never logged, and never transmitted to Calamari's servers. The credential vault stores account numbers and server names for reconnection purposes; passwords are not retained after the login operation completes.

Each Tentacle is provisioned with a unique, randomly generated API key. This key is stored in Windows Credential Manager on the appliance — not in a configuration file — and is never transmitted in plaintext. Customers can rotate their API key at any time through the dashboard; the old key is invalidated immediately upon rotation.

Calamari staff do not have standing access to customer Tentacles. Temporary support access requires explicit customer authorization and is time-limited. Every access event — including the timestamp, purpose, and personnel involved — is logged in the immutable audit trail on the appliance.

The Calamari Watchdog Controller monitors every active Tentacle from outside the Tentacle's failure domain. This is a critical design principle: if a Tentacle crashes, freezes, or loses network connectivity, the monitoring system detects the failure independently because it does not rely on an agent running inside the Tentacle itself.

Health checks run every 30 seconds. If a Tentacle fails to respond within the configured threshold, the Watchdog initiates an automated recovery sequence: it attempts a graceful service restart first, escalates to a full appliance restart if needed, and alerts the operations team for manual intervention if automated recovery does not succeed within the recovery window.

Calamari is an early-stage infrastructure company. We are not currently SOC 2 Type II certified. We are building toward that certification as part of our Phase 6 roadmap (Q1 2027). The controls described on this page represent our current implemented security practices, not a certified audit outcome.

Our privacy practices are designed to be consistent with GDPR and CCPA requirements. We do not sell customer data, we do not use trading data for any purpose other than service delivery, and we provide data deletion on request. See our Privacy Policy for the complete data handling disclosure.