What JorgAI Can and Cannot Do in Your Brokerage Account
Last updated: October 28, 2026
Part of the JorgAI security and trust documents.
| Document control | |
|---|---|
| Document | What JorgAI can and cannot do in your brokerage account |
| Applies to | Every broker and exchange connection JorgAI offers |
| Last reviewed | October 28, 2026 |
| Owner | Founder, JorgAI LLC |
| Source of truth | JorgAI's broker integration code and each broker's published API documentation |
| Related documents | Information Security Policy; Cybersecurity Policy; Privacy Policy (jorgai.com/privacy); Terms of Use (jorgai.com/terms) |
The short version
JorgAI trades inside an account you already have, at a broker you already use. It can read your balances, positions and orders, and it can place and cancel orders within the rules you set. It cannot withdraw or transfer money, link or change a bank account, change your password or login details, or open or close accounts. Those actions are not part of any connection JorgAI uses, so there is no setting that could turn them on.
Every connection is one of two kinds:
- A sign-in at the broker (OAuth). You sign in on the broker's own website and approve JorgAI. JorgAI receives a token scoped to account data and trading. It never sees your password.
- An API key you create at the broker or exchange. You choose the key's permissions when you create it. The connection guides say which permissions to turn on and which to leave off; withdrawals are always off.
Either way the credential is encrypted before it is stored, with a key held separately from the database, and it is deleted the moment you disconnect.
Broker by broker
Charles Schwab
| How you connect | Sign in on schwab.com and approve JorgAI (OAuth). Schwab requires you to re-authorize every 7 days. |
| JorgAI can read | Account balances, positions, orders, transaction history, quotes |
| JorgAI can do | Place, modify and cancel stock and ETF orders in the connected account |
| JorgAI cannot do | Move money in or out, change bank links, change login or profile details, trade crypto (not exposed to the Trader API) |
| How to revoke | Remove JorgAI under linked applications in your Schwab security settings, or click Disconnect in JorgAI, which deletes the tokens |
tastytrade
| How you connect | Sign in on tastytrade with two-factor on and approve JorgAI (OAuth). No periodic re-authorization. |
| JorgAI can read | Account, balances, positions, orders |
| JorgAI can do | Place and cancel stock and ETF orders |
| JorgAI cannot do | Deposit or withdraw, change bank links or login details, trade futures, options or crypto through JorgAI |
| How to revoke | Revoke JorgAI under connected applications in your tastytrade settings, or Disconnect in JorgAI |
Alpaca
| How you connect | API key and secret you create at alpaca.markets (paper or live), or Alpaca's sign-in where it is offered |
| JorgAI can read | Account, positions, orders, quotes |
| JorgAI can do | Place and cancel stock, ETF and crypto orders, including fractional and notional orders |
| JorgAI cannot do | Transfer funds, link a bank, withdraw, change account details (the trading keys have no funding endpoints) |
| How to revoke | Delete the key at alpaca.markets, or Disconnect in JorgAI |
Tradier
| How you connect | Access token and account number from dash.tradier.com |
| JorgAI can read | Balances, positions, orders, account history, quotes |
| JorgAI can do | Place and cancel stock and ETF orders (whole shares) |
| JorgAI cannot do | Move money, change bank links or account details, trade crypto (not offered by Tradier's API) |
| How to revoke | Revoke the token at dash.tradier.com, or Disconnect in JorgAI |
Kraken (spot)
| How you connect | API key you create at kraken.com with these permissions on: Query Funds, Query Open Orders and Trades, Query Closed Orders and Trades, Create and Modify Orders, Cancel and Close Orders, Query Ledger Entries. Withdraw Funds stays off. |
| JorgAI can read | Balances, open and closed orders, ledger |
| JorgAI can do | Place, modify and cancel spot crypto orders |
| JorgAI cannot do | Withdraw or deposit, move funds between Kraken products, change account settings |
| How to revoke | Delete the key at kraken.com/u/security/api, or Disconnect in JorgAI |
Crypto.com Exchange
| How you connect | API key you create in the Exchange's API Management with Trading on and Withdrawal off; JorgAI's outbound address whitelisted |
| JorgAI can read | Accounts and balances, orders |
| JorgAI can do | Place and cancel spot crypto orders |
| JorgAI cannot do | Withdraw, transfer to the Crypto.com App, change account settings |
| How to revoke | Delete the key in API Management, or Disconnect in JorgAI |
The "cannot do" column is not a promise JorgAI makes about its own behavior. It describes what the connection itself does not include: the API endpoints JorgAI calls are accounts, positions, orders, history and quotes, and the OAuth scopes and key permissions do not cover money movement. A connection cannot be used for something it was never granted.
The rules that bound every order
Inside the account, every automated order passes the limits you set before it is sent: the number of auto-trades a day, the maximum spend per trade and per day, the maximum open positions, the stop-loss and take-profit on each position, the daily loss limit that pauses trading after a defined drawdown, and the confidence threshold a setup must clear. You can also require your approval before any buy. Selling to protect a position (a stop, a target or a trailing stop) runs on every price check, and a bracket order is placed at the broker as well wherever the broker's API accepts one, so a stop stays in force even if JorgAI's connection drops.
What JorgAI stores, and what happens when you disconnect
JorgAI stores the token or key, encrypted, the account identifier, and the trade and position records it manages for you. It never stores a brokerage password. When you disconnect, the credential is deleted at once and the account's trading data is hidden from the app; reconnecting the same account restores the history. Positions that are open at the broker stay open at the broker; you manage them there until you reconnect.
How to check for yourself
Each broker lists the applications and keys that can access your account, and what each one is allowed to do:
- Schwab: your security settings on schwab.com, linked applications.
- tastytrade: account settings, connected applications.
- Alpaca: the API keys page of your dashboard at alpaca.markets.
- Tradier: dash.tradier.com, API access.
- Kraken: kraken.com/u/security/api.
- Crypto.com Exchange: the API Management page.
If anything there does not match this page, remove the access at the broker and write to support@jorgai.com.
Why this page exists
In October 2026 several brokers announced their own AI trading connections, and the question "what can an AI actually do inside my account" became a question members ask before connecting. This page answers it for JorgAI's connections in one place. It is updated when a connection or a broker's API changes.