eToro API keys, Telegram tokens and two-factor secrets are encrypted with a server-side key (Fernet, AES-128 + HMAC). A copy of the database file alone doesn't reveal them, and the app never displays a saved key again, not even to admins. The server has to decrypt keys to place your orders, so anyone with full access to the server or its key file could in principle read them. Use a key with only the permissions you need, and revoke it in eToro whenever you like.
Every record carries its owner's id and every query is filtered by the signed-in user; the code refuses to run a data query without a user context. Admins see per-user totals, not trade details.
Passwords of 12+ characters, hashed. Two-factor codes, required for real money and admin actions, with one-time recovery codes. Lockout after repeated failures, per-network limits, and the same message whether or not a username exists. Sessions expire after 12 idle hours (7 days at most), can be signed out per device, and end on password change, block or reset.
HTTPS with HSTS, CSRF tokens on every form, a Content-Security-Policy that only runs the site's own scripts, no framing, no caching of signed-in pages, sign-out by POST only.
New accounts are demo-only. Real money needs the admin's permission, two-factor sign-in and typing REAL to confirm, and the bot is paused at the switch so you review before it trades. Leverage is capped per user by the admin.
Sign-ins, account requests, admin actions and strategy-lab runs are recorded with time and network address.
To stop Sonzoy at once, delete its API key in eToro: Sonzoy can then neither read nor trade. You can also download your data or delete your Sonzoy account in Settings. Deleting the account doesn't close positions in eToro.
Sonzoy runs on a single server operated by its administrator. There has been no independent security audit, and no system is safe from every attack. Stop-losses are held by eToro and can fill at worse prices in fast markets.