StockToken does not primarily sell an app or an order book. Its own wording on the terms page is: a decision-engine and accounting platform that lets participants access algorithmic strategies executed in their Alpaca Markets brokerage account. Figures in this review were collected on 24 August 2026 from the operator's public pages and can change.

That is where comparisons with crypto exchanges usually go wrong. Opening an account here is not the same as lodging crypto with an exchange wallet. The platform generates signals, filters them, routes approved orders to the broker and keeps an internal ledger of each participant's proportional claim on a strategy pool.

What the platform says it is not

The terms open with „Read this before participating“. They state that StockToken is not a deposit or savings account, not a guaranteed-return product, not a fixed-yield instrument and not investment advice. NAV can fall. Receiving less than you put in is inside the documented risk.

Tokens on the platform are, according to the operator, not blockchain assets and not transferable off-platform. They represent an on-ledger claim against the operator-managed pool — not a segregated fund in the banking-law sense.

The same page carries a template notice: the document is a starting point, not legal advice, and should be replaced with lawyer-reviewed terms before production use. That is unusually candid — and a warning. Reading the page as a finished contract contradicts the operator's own wording.

Operator and supervision

The operator is Blockchain Asset Management Ltd., an International Business Company in the Bahamas, registration no. 201522, incorporated in March 2022 according to the about page. Founder and CEO is Nicolas Potier. The terms are explicit: an IBC is a corporate vehicle, not a financial-services licence. Nothing in that block asserts permission to provide regulated financial services in any jurisdiction.

For readers in Germany that means, concretely: no BaFin authorisation and no MiCAR CASP licence. Execution is intended to run through Alpaca Markets, an independent US broker-dealer. Where the dashboard and the broker statement disagree, the terms say the broker's statements govern. Interactive Brokers and Tradier are named as possible additional connections, not as the default.

Jurisdictional write-ups (including Bahamas, US, EU, UK) are pointed to the „Regulatory assessments“ page. That is not a substitute for the investor's own regulatory check.

Security: four layers, two open items

The security audit page is written for security teams. The operator states that the measures below are implemented in code, not aspirational.

The layers, as published there:

  1. Edge: Cloudflare TLS, per-IP rate limits, request body-size caps.
  2. Authentication: PBKDF2-SHA256 at 100,000 iterations with a 128-bit salt; 20 sign-in attempts per IP per five minutes; 15-minute lock after ten consecutive failures; JWT access tokens with a 15-minute TTL; server-revocable sessions; a 6-digit PIN, once set, also required for withdrawals and password changes.
  3. Validation: typed request schemas, role checks, per-user rate limits.
  4. Ledger: four accounting invariants before every atomic commit, with an audit row in the same batch.

The threat-model table names two gaps: device binding is not covered (roadmap). Step-up 2FA for withdrawals and admin role changes is planned, not yet live. Marketing copy often omits those sentences.

Responsible disclosure: reports to [email protected], a stated 48-hour acknowledgement, no legal action against good-faith researchers in scope. Out of scope: social engineering, production DoS, and third-party vendors (Alpaca, IB, Tradier, Polygon.io, Databento).

Insurance: £30m, checkable — with limits

The same audit page lists policy PATFH159 with Superscript (trading name of Enro Limited, FCA reg. 656459, England and Wales). Cover period 23 May 2026 to 22 May 2027. Cyber security £25m, professional indemnity £5m.

This is not deposit protection and not cover for market losses. As far as the informational text goes, it addresses incident response, ransomware, business interruption, privacy liability and professional negligence. The operator itself says the Evidence of Cover and Statement of Fact are the controlling documents; the web page is informational only. Counterparties can request the policy via [email protected], with identity checks.

Strategies and figures — without the marketing graphic

Three books are described publicly: CORE (equities/ETFs/short-duration Treasuries, 12–15 percent monthly target range, no AUM cap), EDGE (Nasdaq-100 plus BTC/ETH/SOL, 20–28 percent, $20m cap), APEX (higher volatility, 30–38 percent, $10m cap). Those figures are ranges on the website, not guarantees.

On the proof page, reported AUM on 24 August 2026 was about $10.56m at $1.00 par. „Locked in tokens“ about $9.31m. The homepage at the same time showed CORE around $5.80m, EDGE $2.32m (about 11.6 percent of the $20m cap) and APEX $1.19m (about 11.9 percent of the $10m cap). These are operator snapshots, not an audited set of accounts.

An older review figure of „around 30 investors and $9.6m AUM“ is therefore stale. The current proof total is higher; an independent confirmation of participant count was not available at collection.

Cash lock and token trading

From the public product copy: a 365-day cash lock applies from first strategy participation. Tokens are described as saleable on an internal P2P market; the buyer pays in USDT and the seller is credited. Each token is issued at $1.00 par. Yield is described as minting new tokens rather than paying cash.

For liquidity planning that means: anyone who needs cash is bound by the lock unless they find a buyer on the internal market. That is not an exchange order book with statutory best execution.

Assessment for investors in Germany

StockToken's strength is not a German licence — it does not have one — but that it writes its own limits down: IBC rather than a financial licence, a template notice in the terms, named security gaps, and a policy number instead of a vague „insured“ claim.

The weakness is structural. Double-digit monthly target ranges are highly speculative. Execution depends on a US broker. The tokens are not a MiCAR crypto-asset and not a segregated fund. Anyone expecting German WpHG or MiCAR investor protection will not find it here.

At most suitable for people who understand the model (signals plus Alpaca plus an internal ledger), can live with the cash lock, and can absorb a total loss. Unsuitable as a substitute for a regulated custody account or as a „safe“ alternative to a CASP.

Scoring

Transparency: 5 out of 5. Terms, threat model and policy are public and specific.

Security: 4 out of 5. The documented architecture is detailed; device binding and step-up 2FA are still missing.

Regulation: 2 out of 5. Bahamas IBC, no BaFin/MiCAR. Alpaca carries the broker supervision, not StockToken.

Product clarity: 4 out of 5. The distinction from an exchange and from blockchain tokens is clear. The template status of the terms remains a caveat.

Algorithmic strategies can produce rapid and sustained losses, including total loss of capital. This review is not investment advice.