Non-Custodial FinTech: Historical Bar Replay & Isolated Portfolio Sleeves for Alpaca

Building software for active traders and DCA investors presents unique security and latency hurdles. The moment an application handles brokerage credentials or order routing, custody risk escalates exponentially. When building Replaytape / AlphaPal (replaytape.com), we architected a non-custodial model where users retain 100% control of their brokerage keys and capital.

The Custody Paradox in Retail Algo Trading

Most third-party trading tools store Alpaca API keys and secrets in central server databases. This creates an intolerable honey-pot risk: a single compromised database leak exposes the accounts of thousands of retail traders.

Replaytape eliminates this attack vector entirely through client-side Web Cryptography:

• Brokerage API keys and secrets are encrypted in the user's browser using AES-256-GCM derived via PBKDF2 from a user master passphrase.
• The plaintext keys never touch our servers or persistent logs.
• Outgoing order dispatches are signed and routed directly to Alpaca endpoints with nonces and ephemeral execution tokens.

Historical Bar Replay Engine

Testing algorithmic strategies against historical market conditions requires intuitive visualization. We built a high-performance tick and bar replay engine that allows traders to step through historical sessions bar-by-bar, observing indicators, volume profile shifts, and simulated fills in plain English.

Isolated Strategy Sleeves

A single brokerage account often executes multiple divergent strategies simultaneously: a long-term momentum DCA sleeve, an intraday mean-reversion sleeve, and an options hedge sleeve. Replaytape introduces virtual portfolio sleeves that isolate capital allocations and track performance independently within a single underlying Alpaca account.

Architecture Highlights

[User Browser] 
    ├── AES-256-GCM Key Vault (Client Memory Only)
    ├── Canvas / WebGL Bar Replay Renderer
    └── Drift-Aware DCA Calculator
          │
          │ (Encrypted Direct TLS)
          ▼
   [Alpaca Brokerage API] ──> [Order Execution & Portfolio Ledgers]

Engineering Lessons

Zero-knowledge client-side security is more than an ideological stance—it radically minimizes regulatory liability, reduces compliance burdens, and provides institutional-grade reassurance to quantitative traders.