Ultima Academy · Internal Proposal
Academy Login: Fully Independent,
Zero Connection to Trading Systems
How Ultima Academy runs its own member login without touching any Ultima Markets backend — what we build and operate ourselves, and the one thing we need from the platform team.
Prepared by the Academy project · July 2026 · One page, ~3 min read
TL;DR — Ultima Markets' backend runs the live trading platform, so opening it to Academy login is a security and priority problem for them — and an unnecessary risk for everyone. Instead, Academy runs its own standalone authentication (a managed auth service), stores only education data (name, email, phone, course progress & points), and uses zero integration with trading systems. The Academy project builds and operates this backend itself; the only thing we ask of the platform team is help publishing the site.
1 · Why not connect to the mother company's backend
- Their database is the live trading platform. Client funds, KYC, positions — the most sensitive data in the group. Any integration bug becomes a financial and regulatory incident.
- We don't actually need it. Academy login only needs to remember who a learner is and what they've studied. None of that requires trading data.
- Isolation protects the mother company. If Academy never connects, Academy can never break anything. This is the architecture their security team would recommend anyway.
2 · Proposed architecture — the "zero-connection" map
Users
Learners & Partners (browser)
Sign up, log in, track course progress, register for webinars.
▼
Front end · built & owned by Academy
Academy website
Hosted on Cloudflare Pages. Uses brand & design resources from Ultima Markets only — logos, fonts, content. No code or data link.
▼
Auth & data · built & owned by Academy
Managed auth & database (Academy's own account)
Managed login: sign-up, password reset, sessions — all built in. Database stores education data only. Row-level security on by default.
Ultima Markets · untouched
Trading platform & client database
Client accounts, funds, KYC, positions. Academy never reads from or writes to any of it. Nothing to approve, nothing at risk.
Ultima Markets · provides
Brand resources only
Logo, visual identity, fonts, market-education content. One-way, front-end assets — no systems access.
3 · What Academy stores — and what it never will
| Data | Stored by Academy? | Notes |
|---|
| Name, email & phone | Yes | Account identity + the contact details sales follow up on. Passwords are fully managed by the auth service (hashed, never visible to us) and the Academy password is completely separate from the Client Portal password — no interoperability, no sync. |
| Course progress, webinar sign-ups, points balance | Yes | The whole point of logging in — resume learning, track completion, unlock advanced courses. |
| Partner referral code (optional) | Yes | A plain text code an IB shares — a label, not a link to any trading account. |
| Trading accounts, balances, positions | Never | Lives only inside Ultima Markets. Academy has no credentials, no API access, no pathway to it. |
| KYC documents, ID, proof of address | Never |
| Payments / card / banking data | Never |
4 · Member mechanics — manual first, no integration
- Free sign-up unlocks intermediate courses; advanced courses unlock with learning points.
- Points come from learning activity, inviting friends (referral system in a later phase), and a one-time deposit match: clients who fund ≥ USD 500 at Ultima Markets receive 10,000 points, credited manually within 48 hours — once per client.
- The match is a human email check done by local marketing against UM's own CRM. No API, no sync — the zero-connection rule holds. If volumes grow, results can justify automating later.
5 · Rollout — four small phases
0
Prototype
Full UX demo in the final stretch: login, member views, partner CRM, EN/中文.
In progress · ~2 weeks
1
Auth service setup
Open Academy's own account on a managed auth platform; enable email sign-up/login; swap the prototype's mock login for real auth.
~1–2 weeks
2
Member data
Store real course progress and webinar registrations per user; wire the partner dashboard to real referral data.
~2 weeks
3
Review & launch
Internal security review, privacy policy update, sign-off, go live on Cloudflare Pages.
~1 week
6 · Who owns what
| Party | Role | Responsibility |
|---|
| Academy project | Builds, operates and owns | Product decisions, content and UX, plus the entire build: the website, the managed auth service and the member database, including security configuration (row-level security, least privilege) and accountability for Academy user data. |
| Platform / front-end team | Deployment support — the ask | Help publish the site to its final address and keep that pipeline working. No development, no database access, no responsibility for Academy data. |
| Ultima Markets IT | Informed only | No integration requested, nothing to build or approve beyond acknowledging the zero-connection design. |
7 · Cost & maintenance
- Base cost: $0. The free tier covers roughly 50,000 users, with Google / Facebook / Apple login built in. Site hosting on Cloudflare Pages is already free.
- Optional security add-ons ≈ USD 0–50 / month, depending on how much we care to harden.