Due Diligence Questionnaire (DDQ)

This page answers the questions professional investors ask before allocating. It is intentionally specific — allocator due diligence is a technical exercise, not a marketing one. The full PDF DDQ (long-form, with quarterly updates) is available on request via the Investor Room.

Scope note. DataFortress.cloud GmbH is a quantitative research GmbH without BaFin authorisation. Any live capital deployment for professional investors takes place through a licensed third-party structure (white-label KVG or Haftungsdach). Questions below distinguish between the research portal (this site) and the execution structure (the licensed partner).

1. Strategy & investment process

1.1 What is the investment universe? Liquid US & EU equities, G10 FX, gold/precious metals, and major crypto pairs (BTC, ETH). Concentration limits are set per strategy; no single instrument exceeds 20% of paper NAV at entry.

1.2 What is the expected holding period? Ranges by family: event-driven strategies hold minutes to days; trend and regime strategies hold days to weeks; portfolio-optimisation strategies rebalance weekly.

1.3 How do you avoid overfitting? Strategies are evaluated on out-of-sample live paper trading, not backtests. Backtests are used as a sanity prior, never for capital allocation. Published leaderboard is ranked by live Sortino only. Strategies that underperform their backtest by >50% are flagged and, if the divergence persists, retired.

1.4 What is the capacity of the strategies? Depends on the instrument. FX and major-index strategies scale into the tens of millions USD. Small-cap equity and thin crypto pairs have lower ceilings; specific capacity analysis is included in the investor deck.

2. Risk management

2.1 How are drawdowns monitored? Every strategy writes daily marks to append-only Postgres. Drawdown is tracked intraday; a strategy that reaches -25% from seed is automatically suspended pending review. The number of live strategies suspended in the last 12 months is reported quarterly.

2.2 What happens in a flash crash or extreme-volatility event? Strategies include per-order position-size caps, daily-loss circuit breakers, and dependence on the underlying exchange’s own market-halt behaviour. Orders use limit, not market, execution by default — a mitigation against bad fills during thin books.

2.3 How is leverage handled? Paper strategies are unleveraged except where explicitly stated on the strategy page. For structured deployments (managed account, fund), leverage is constrained by the licensed partner’s risk framework and the fund prospectus.

2.4 Do you run stress tests? Historical stress windows (Mar 2020, Oct 2022, Aug 2024) are re-evaluated on each new strategy. A Monte-Carlo bootstrap over daily returns is published in the investor deck with a 95% CI on maximum drawdown.

3. Technology & infrastructure

3.1 Where is the execution stack hosted? Kubernetes cluster on dedicated hardware in an EU data centre (single-region). Strategies run as CronJobs; market-data ingestion is a separate deployment. See Infrastructure & Security for the full topology.

3.2 What is the execution latency? For paper trading, latency is not material (end-of-day marks). For live execution under managed-account or fund wrappers, orders route via broker APIs (IB, Alpaca, Varengold) with sub-second round-trip from signal to order.

3.3 How are API keys and secrets managed? All broker API keys are non-withdrawal (trade-only scope) where the venue supports it. Keys are stored as Kubernetes Secret objects with restricted RBAC, rotated at least quarterly, and never committed to git.

3.4 What is the failover / continuity plan? The public portal is served from a static build (hostPath → nginx) with no dynamic dependencies — a node failure causes at most one missed daily refresh. For live execution (under the licensed partner), the Haftungsdach / KVG maintains its own regulated redundancy. Founder succession planning is documented with counsel; see § 5.4.

3.5 Is the codebase auditable? Yes. The research framework is open source (python_tradingbot_framework). Every signal can be reproduced by a qualified reviewer from the published source and a Postgres snapshot.

4. Compliance & regulatory

4.1 What is your regulatory status? DataFortress.cloud GmbH is an unregulated GmbH and holds no BaFin authorisation. This research portal operates under reverse solicitation. Any revenue-generating arrangement with professional investors is structured under a licensed third party — a KVG (fund wrapper) or a Haftungsdach (managed account under a BaFin-authorised umbrella).

4.2 How do you onboard investors legally? Through the KVG / Haftungsdach partner’s onboarding process, which includes full KYC, AML, suitability assessment (where applicable), and PRIIPs disclosures (for retail-eligible share classes — not offered by us).

4.3 Who is your auditor? For the GmbH itself: audited annually per HGB requirements. For any fund wrapper or managed-account umbrella, the partner’s appointed auditor applies — named in the DDQ PDF.

4.4 AML / KYC? Handled by the licensed partner (KVG or broker). DataFortress.cloud GmbH does not hold client funds and is not a payment or custody entity.

5. Governance & team

5.1 Who runs the strategies? See the Team page for the founder’s background and credentials.

5.2 Skin in the game? The founder maintains personal capital in the live execution book. Percentage disclosure on request under NDA.

5.3 Fee structure? Standard allocator-terms framework: 1% / 15% (management / performance, high-water mark) for managed accounts; fund share-class terms as per the prospectus. No retrocessions or kick-backs to third parties.

5.4 Key-person / succession risk. Acknowledged. Mitigation plan documented with external counsel; allocators receive the plan during deep due diligence. Research infrastructure is fully open-source so strategies can be reconstituted independently of the founder.

6. Verification & third-party audit

6.1 Are returns verified by a third party? We are currently in the process of integrating with Collective2 and Myfxbook for automated, independent track-record verification. Until then, we provide cryptographically signed snapshots of our Postgres performance tables upon request for professional due diligence.

6.2 Can we audit the track record directly? Yes. For institutional allocators, we can provide read-only access to our Postgres audit trail (containing every daily portfolio mark since inception) under NDA. Since the research framework is open-source, these marks can be cross-verified against historical market data.

6.3 Future audit plans? As we transition to a regulated fund wrapper (KVG), the returns will be audited by the KVG’s appointed auditor (Big Four or specialized boutique) as part of the fund’s annual report.

Still have questions?

Submit your full DDQ checklist through the Investor Room form; we respond with the long-form PDF and will schedule a video call with the founder.