Private feeds, controlled access.

Client-specific feed boundaries

Every client feed has its own pricing rules, quote state, persisted state, delivery configuration, dashboard, and monitoring identity.

Private liquidity and client-provided prices stay inside the account that owns them. Public reference sources may be shared efficiently, but client data is not treated as a common pool.

One feed’s configuration error is also contained as far as possible so it does not automatically stop every other client feed.

HTTPS dashboard access

Client dashboards are served over HTTPS. Certificate issuance and renewal are managed automatically for provisioned hostnames.

Management access is restricted separately from the public HTTPS dashboard path.

Client operational dashboards remain authenticated and excluded from public search indexing.

Passwordless sign-in

Dashboard users sign in with a time-limited email link. A redeemed link is single-use, and the resulting session works across the provisioned servers for that client.

There is no shared dashboard password for a team to distribute or forget to rotate when staff changes.

Access follows the sharing list of the client’s own pricing-rules sheet. A sharing change takes effect after dashboard permissions are next refreshed.

Reader and writer permissions

A reader can inspect quotes, source relationships, schedules, status, and the loaded configuration.

A writer can also perform actions that may affect live pricing, such as re-reading validated rules or clearing protected quote state.

This role split gives operations and management useful visibility without giving every viewer the ability to change the feed.

Protection for state-changing actions

Dashboard actions that change pricing state require an authenticated user with the appropriate role and are protected against unauthorized browser requests. Access sessions are time-limited.

Access remains resilient

Dashboard access does not depend on a live permissions-provider response for every request. During a temporary provider outage, the last successfully refreshed permission state can remain available instead of being replaced by an incomplete result.

Privileged actions are logged

Sign-in, sign-out, rules reloads, quote-state resets, and administrative changes are written to the operational log with the requesting user where applicable.

That provides a trace when a team needs to answer who requested a change and when it occurred.