Execution map
One live account · 1,112 fills · 5 weeks
Volume traded
$205,901
Fees paid
$129.31
Avoidable premium
$54.40
Per $1M traded
$264.20
Fragmentation
38%
Worst order
23 fills
The engine ships with the page and runs in this tab. Open the network panel, drop a file, watch the counter stay at zero. A fill history never leaves the machine it is on, because there is nowhere for it to go.
Drop a fill history export
Tested against Bybit, Binance and OKX exports and against Hummingbot and Freqtrade logs. Other venues go through a generic CSV reader that guesses the columns — usually right, and it tells you when it is not sure. No API key, no account.
Measure
Read every fill and price it against your own maker rate.
Attribute
Split the cost by instrument, by hour, by strategy.
Act
A ranked list of what to fix, ordered by what it costs you.
A fill export records what happened. It does not record what the book looked like at the time, and it does not record what your bot meant to do. Those are three different questions, and which input you give us decides how many of them we can answer. Nothing below needs an API key.
Drop in a file
One export. Offline, in this tab, zero requests to anyone.
Fee leakage
FreeWhat you paid, priced against your own maker rate.
Maker/taker premium
FreeThe share of fills that took liquidity, and what that cost.
Rate reconciliation
FreeYour effective rate against the venue's published schedule.
Order fragmentation
FreeHow often one instruction returns as many fills.
Realised dispersion
FreePrice spread inside a single order, bucketed by fill count.
Timing
FreeCost by hour of day — the same strategy on a thinner book.
Concentration
FreeWhich instrument carries the leakage, and how much of it.
Funding cost
FreeCarry on perpetuals, separated from execution.
Venue comparison
FreeThe same flow priced at another venue's schedule.
Data integrity
FreeDuplicates, sign errors and mislabelled rows in the venue's own export.
Connect the agent
A local process that reads your exports on a schedule and pulls public candles from the venue you already trade on — from your machine, not ours.
Slippage vs mid
StarterYour fill against the midpoint at that moment. Needs market data.
Spread at fill
StarterHow wide the book was when you took it.
VWAP and TWAP
StarterYour execution against the market over the same window.
Market drift
StarterWhether the move happened before or after you traded.
Fill and cancel rate
StarterWhat share of resting orders ever filled. Needs the order stream, not just fills.
Baselines and drift alerts
StarterContinuity: today's number against your own history.
Pool benchmark
StarterYour cohort, once at least twenty accounts sit in it.
Adverse selection
DeskWhere the price went right after your passive fills.
Market impact
DeskWhat your own size did to the book.
Implementation shortfall
DeskDecision price to final fill, with the delay cost split out.
Per-strategy attribution
DeskSeveral accounts and venues, one number each.
What neither input can tell you
- Slippage against your intended priceNeeds your bot's own intent log. A fill export records what happened, never what was meant.
- Queue positionNeeds the venue's per-order book state. No public feed exposes where you sat in it.
- The counterfactualWhat the same strategy would have paid with different logic. We measure, we do not simulate.
- Whether the strategy is any goodThis is execution cost, not alpha. A profitable bot and an expensive one are separate questions.
01
Institutional TCA is enterprise-priced
Transaction cost analysis has measured exactly this for twenty years. It comes with annual contracts, procurement and integrations measured in months, and it serves funds with compliance departments.
02
Trade journals assume a human
Everything built below that line is designed around a person clicking buy a few times a day. They count trades. None of them measure execution, and none of them see an order break apart.
03
The desks in between are where this starts
Teams running real strategies at real size, on retail exchange APIs, losing real money to execution with no tooling that speaks their language. They are the beachhead rather than the market, because they hold the data and can check the arithmetic themselves. The same measurement goes up — to prop desks and funds kept out of institutional TCA by procurement rather than by budget — and sideways, to the far larger number of people who buy a bot instead of writing one and have no way to tell whether it executes well. None of them can grade themselves, which is the whole point.
Every tool that touches trading data promises to be careful. That promise is worth nothing, which is why this is architecture instead. Three layers, three different guarantees, each one checkable rather than stated — and each labelled with what is running today.
Why market comparison does not break this
Comparing your fills against the mid needs public candles. Those requests go from your machine directly to your own exchange— the venue you already trade on, which already knows every order you have ever sent it. We never make that request, so we never learn which instruments you trade. If we fetched candles on your behalf, the list of pairs we asked for would be your strategy. The site’s Content-Security-Policy names those venue hosts explicitly and allows nothing else, so the set of places this page can reach is a closed list you can read.
Your fills
Never sentThe engine ships with the page and runs in your browser. Drop a file and the parsing and the arithmetic happen on your machine, with no request to anyone — the network panel stays at zero while it works.
We hold none of it. Not encrypted — absent, because there is no endpoint that accepts it.
Your history
SealedCrypto shipped · sync in build
Per-instrument and per-hour detail is encrypted in your browser before it is stored anywhere: a random AES-GCM key, wrapped by a key derived from your password with 600,000 rounds of PBKDF2-SHA256. We would hold ciphertext and could not open it, including if someone required us to.
You get a recovery key at signup — the only other way in. We hold neither it nor your password, and cannot make a copy of either.
The pool
PseudonymousSchema shipped · pool opens at 20
A closed list of 8 rounded numbers with no instrument names, sent under an identifier that is derived fresh each period from a secret your browser never transmits, with Laplace noise at ε=0.5 per field.
Nothing is returned until at least 20 accounts sit in a cohort — and the rounding is what makes a stolen database useless: no row can be traced back to an account, including by us.
cohort "10-50M/perps" fills 1100 maker_rate_bps 3.6 taker_rate_bps 7.4 taker_share 0.71 fee_bps 6.3 leak_per_million 264 frag_share 0.38 top8_share 0.80
What is never sent
- Instrument names — the set of pairs is the strategy, and even asking for their candles would give it away
- Individual fills, prices, sizes or timestamps
- Order identifiers
- Balances, open positions, leverage
- API keys — we never ask for one, at any tier
- Deposits, withdrawals, your name or jurisdiction
The agent is closed source — it is the product. What replaces reading the source is narrower and harder to fake: the schema above is the whole schema, the agent refuses to send a payload carrying any key outside it, and --dry-run prints the exact bytes without sending them. It reports its own errors to a local file rather than to us: if something breaks, you decide whether to share it, after seeing what it contains.
How the recovery key works
- Your browser generates the key that encrypts your history. It never travels.
- It is wrapped twice — once by your password, once by the recovery key you save at signup. Each wrap has its own salt, so changing one never invalidates the other. We would store both sealed envelopes and can open neither.
- Either one lets you in. Forget the password, use the recovery key. Change your password and only that envelope is rewritten, not your data.
The first audit is free because seeing the number once is the whole argument. What you pay for after that is continuity. Execution drifts — the market thins, the strategy changes, the venue moves your fee tier — and you find out the same way you found out the first time, which is to say not at all.
Free
What is my number?
$0
one audit · no account
- Fee leakage and maker/taker premium
- Fragmentation and realised slippage
- Timing, concentration, funding cost
- Venue comparison and rate reconciliation
- Data integrity checks
Everything computable from your own fills, with zero requests to anyone.
Starter
When did it get worse?
$29
/moone account
- Everything in Free
- VWAP, TWAP and market drift
- Slippage vs mid, spread at fill
- Fill rate and cancel rate
- History, baselines and drift alerts
- Benchmark against the pool
The report tells you where you stand. This tells you when it changes.
Desk
Which strategy is to blame?
$99
/moseveral accounts
- Everything in Starter
- Adverse selection and market impact
- Implementation shortfall and delay cost
- Multiple accounts and venues
- Per-strategy attribution
- Alerts to Slack or Telegram
When you run three strategies, one number stops being useful.
Firm
Can it run inside our perimeter?
$349
/moinside your perimeter
- Everything in Desk
- Self-hosted deployment
- Metrics into your Prometheus
- Grafana dashboard and alert rules
- Direct channel, 4-hour first reply
- 99.5% uptime, month free below 99%
For desks whose fill data does not leave their own network.
Free runs today. Starter and above open when the agent ships — they are what it adds. Leave a contact and you will hear on the day, before anyone else.
Annual billing takes two months off. No API key at any tier, ever — every level reads the same exports, and market comparison runs from your machine to your own venue.
Hear when the agent ships
The agent is what the paid tiers add: it reads your exports on a schedule and prices your fills against the market. Leave an email or a Telegram handle and you will hear on the day. One message, then nothing.