How fills are actually fair
How trading works covers the basics: real prices, simulated exposure. This page covers what "provably fair" actually means at the level of a single fill, for anyone who wants more than the summary.
Every fill traces back to a price no one at the firm chose
Prices come from public exchange data, aggregated across several venues rather than taken from one. Nobody at a firm sets or adjusts the base price a fill is computed from, and no firm can see or influence which venue a quote came from. Every price we publish is committed to a running hash chain before any fill uses it, so the number your fill was priced against is fixed in public before it is applied to you and cannot be revised afterwards.
The spread is separate from that base price. It comes from a published per-symbol profile, not from the feed, and which of the two profiles applies to your account is the one you chose when you bought the evaluation. On top of the base price a fill applies that spread and, in the platform's verified mode, a slippage draw that's symmetric and mean-zero, meaning it isn't biased against the trader over time, it isn't a small structural tax it just doesn't announce.
Every fill can be independently rebuilt, not just trusted
Each account gets its own seeded random-number stream at the moment it's created. That has a specific, useful consequence: any fill that account ever received can be deterministically reconstructed later and checked against what should have happened, because the same seed produces the same sequence every time. This is what actually backs the claim that fills are provable rather than merely asserted, a fill isn't a black-box output, it's a reproducible calculation.
An internal audit specifically tried to find a bias, and didn't
A dedicated fidelity audit exists whose entire purpose is checking whether the engine manufactures any edge against the trader, replaying fills byte-for-byte and checking the aggregate outcome distribution for exactly this. Its finding: no manufactured house edge. The audit was run against verified templates specifically, so the strongest statement it supports on its own is about that mode.
Nothing in the engine can target one account
No firm operator and no platform administrator can single out an account and change what it pays. There is no branch anywhere in the fill path that reads who a trader is and decides to treat them differently, and nothing in it looks at an account's balance, its profit, or any flag against it.
What does vary between accounts is the execution profile the trader picked themselves when they bought the evaluation, and it varies only in the two ways that card describes: a fixed spread with no slippage, or a tighter spread that moves with the market plus a small slippage draw on entry and exit. Both options are priced the same for everyone who picks them, and the choice is made before any money is at stake, by the person it applies to.
Integrity findings don't reach execution either. When the integrity system flags an account, it acts at the payout and account-status layer. A trader gets the same prices as everyone else.
An automated test reads every file in the execution engine on each build and fails the build if code capable of per-account targeting is ever introduced.
A price feed can't just go stale and get traded against anyway
Fills are rejected outright against a frozen or overly-old price rather than silently filled at a stale number, both at the general feed level and with an additional, account-specific check against the real published time of the underlying price update. A single garbage price print from the feed doesn't move a trader's account either, a lone anomalous tick is held back unless a second tick confirms the move actually happened, protecting against exactly the kind of single-bad-print manipulation a naive feed integration would be vulnerable to.
Every fill leaves a signed, checkable receipt
Each fill produces its own execution receipt showing the exact price breakdown, written atomically alongside the fill itself and cryptographically signed. These receipts can also be bound into the same hourly evidentiary chain that backs settlement (see How settlement actually works), so a fill isn't just fair at the moment it happens, it stays checkable afterward.
What this doesn't cover
This page describes the execution engine's own fairness, whether a given fill was priced honestly against real market data. It's a different question from what the evaluation rulebook enforces (see Evaluations & the rulebook) and from how a firm's overall financial health is managed (see How the risk engine thinks). All three work together, but they're not the same guarantee.