Niubang security and permissions: what the read-only and trading passwords do, where they are stored and how to revoke them
A master account is listed with its read-only (investor) password, which can view but not trade. A copy account uses its trading password so the Niubang cloud can place copied trades. Both are stored encrypted and neither can deposit or withdraw; changing the password in MT5 revokes the old one at once. Pausing only stops new trades.
Niubang editorial · Updated
The two passwords at a glance
Niubang only uses the two login passwords that every MetaTrader account already has. For the details, see “MT5 investor (read-only) password vs trading password”.
| Read-only (investor) password | Trading password | |
|---|---|---|
| When you enter it | Listing a master account (signal source) | Adding a copy account |
| What Niubang uses it for | Reading positions, deals, balance and equity to build the strategy page | Logging in to your MT5 account to open and close trades after the master |
| Can it trade? | No | Yes, copied trades only |
| Can it deposit or withdraw? | No | No; deposits and withdrawals happen in your broker's client area |
| How it is stored | Encrypted with AES-256-GCM in the database | Encrypted with AES-256-GCM in the database |
| How to revoke it | Change the investor password in MT5 or at your broker | Change the trading password in MT5 or at your broker |
What Niubang does not ask for
No broker back-office (Manager) access, no login for your broker's client area (where deposits and withdrawals happen) and no DLL. Copied trades carry a fixed tag, and closing only touches copied trades, never the ones you opened by hand.
Support will never ask for a password in chat. Do not send any password over QQ, Telegram or email; enter passwords only on the website or in the NB Copy Engine panel.
Where passwords are stored and who can see them
Passwords are submitted over https and stored in the Niubang database encrypted with AES-256-GCM. The decryption key lives in the server's environment variables, not in the database. The copy servers decrypt a password in memory to connect to the broker and do not write it to logs.
My Subscriptions, strategy pages and the regular APIs never return a password to the browser. When an account cannot connect and the password needs checking, a Niubang administrator can view that single account's password in the admin console.
Niubang does not currently have a third-party security audit report. If you are unsure, list an account with the read-only password only and do not enable copying, or try copy trading with a small account first.
How to revoke access
The fastest and most complete way is to change the password in the MT5 terminal or your broker's client area. After you change the trading password, the old one stored by Niubang can no longer log in; after you change the investor password, Niubang can no longer read the master account. To continue later, enter the new password.
Think about copied trades before changing the trading password: afterwards Niubang cannot close them for you, so you will need to handle them in MT5. If you simply want to stop copying, cancel in My Subscriptions first so the copied trades are closed, then change the password.
To stop showing a master account, click Delist in My Strategies. It is no longer publicly displayed and accepts no new followers; existing subscriptions and history are retained.
Before deleting your Niubang account, cancel any running subscriptions and delist any listed strategies. Account details are anonymised on deletion; to be certain Niubang can no longer log in to your MT5 account, change the password.
What happens when you change your Niubang password
After you change your Niubang login password or reset it, every signed-in web session ends immediately and you need to sign in again. The NB Copy Engine control token in your MT5 terminal is revoked as well, so the terminal needs to sign in to Niubang again. Old sign-ins also end immediately when an account is banned.
Copy trading already running in the cloud is not affected and keeps running.
Pause vs cancel
Pause only stops copying new trades. Trades already copied stay open and still close when the master closes them; while paused, the system still logs in periodically to check those trades. To close them right away, close them yourself in MT5.
Cancel stops copying and closes the copied trades in the account.
Neither pause nor cancel touches trades you opened by hand.
Copy trading involves risk, and a strategy's past performance does not guarantee future returns.