How Delta-Z ranks firms

Data collection

Every tracked firm has a pricing page that gets scraped via Playwright. On each run we capture the rendered HTML, a full-page screenshot, and a JSON metadata file containing the URL, title, and capture timestamp. These snapshots are persisted under data/snapshots/<slug>/<iso-date>/ so any future dispute about "did the firm advertise X on Y date" can be answered against the raw evidence.

For firms whose pricing pages don't render in headless Chromium (Cloudflare challenge, heavy JS, login-walled tier-tables), we fall back to a hand-verified baseline. Those firms are flagged internally; the directory continues to track them but the data freshness is whatever the operator most recently confirmed.

The rule schema

14 signals per firm:

• Profit split %, profit target %, max drawdown %, daily drawdown %
• Minimum trading days, consistency rule %
• News-trading allowed, weekend-holding allowed
• Copy-trading allowed, EAs allowed, HFT allowed, martingale allowed, grid allowed
• Country restrictions (ISO-3166-1 alpha-2 deny-list)

Every signal maps 1:1 to a public T&Cs assertion. We document the source for anything non-obvious in the firm's hidden-rules notes field.

The trust score

The displayed trust score is base + min(20, max(0, review_weight - 2)).

The base is a hand-set integer between 0 and 100 reflecting payout track record, operational history, broker liquidity, and complaint volume. The review-derived signal adds up to 20 points based on verified reviews, with a per-tier weight: email-verified = 1, dashboard-screenshot-verified = 2, payout-proof-verified = 3, funded-trader-verified = 5. The -2 floor means a single sock-puppet email-verified review never moves the score.

Note: only the email tier currently has a working verification flow. Proof-upload tiers will be enabled in a later release. Until then, the review signal cap is effectively low and the base score dominates.

Review verification

Submitting a review writes a row with is_verified=false and a one-time token. We send the token to the email address via a magic-link. Clicking the link within 7 days flips the row to verified. Tokens expire; tokens are single-use; tokens are never returned by the public API.

The email address is hashed (SHA-256, salted) to allow per-firm dedupe without storing the raw email forever in the public-facing schema. We retain the raw email until verification, then clear it as soon as the GDPR right-to-erasure request handler runs against it (forthcoming endpoint; for now, email our contact address to request manual deletion).

Ranking heuristics

Category pages (best for scalping, best for crypto, etc.) rank with mechanical heuristics that prioritize the trader-style fit signals over headline price. The full heuristics are visible in the source — read src/lib/categories/registry.ts for the exact formula per category.

When we're wrong

We will be wrong. Firms change rules silently; scrapers miss signals; our hand- verified baselines age. If you spot a data error, tell us via contactand we'll re-verify against the firm's live page within 24 hours.