The engines are real. So are the prices.

The rebalancing engine, drift calculation, performance math, tax-lot accounting and tax-loss-harvesting logic you exercise here are the production code paths — the actual software, not a walkthrough — and the securities you hold are priced by the real market data feed.

That split is deliberate and it is the point of the environment. You are evaluating whether the numbers are right, and synthetic prices would make that impossible to judge. What is simulated is everything downstream of a trading decision: fills, custody, settlement and identity verification.

What is real and what is simulated

The boundary is enforced on your tenant, not on the platform

Your tenant's order flow is pinned to the local simulator and to native custody. An account flagged as sandbox cannot dispatch to an external custodian integration, and a request for a correspondent custodian is refused with a 403 naming the constraint — not quietly downgraded. The rule lives in one module every custody-touching path consults, and it keys off the account's own flag — not an environment variable a deploy could flip. Refusing rather than downgrading is a correction. Keeping the requested custodian label while forcing native custody underneath produced accounts labelled DRIVEWEALTH that were not at DriveWealth, and a disclosure screen telling a prospect their SSN had gone to a custodian that never received it.

Precisely: your tenant cannot reach an external custodian. Interpose's own integration testing does run vendor UAT traffic on the same infrastructure, and the isolation between it and your tenant is the same rep-code scoping every firm on the platform runs on.

Your tenant and your seeded book

firm         SBX{n}              flagged is_sandbox
  └── branch MAIN
        └── rep code SBX{n}R01
              └── portal user   role = advisor, scoped to that rep code

You are an ordinary advisor to every service on the platform. The alternative — inventing a sandbox role — would have meant auditing roughly 1,265 endpoints across nine services and remembering the new branch in every endpoint written afterwards, which is precisely the shape of failure that produces cross-tenant leaks.

Provisioning creates a book, because an empty tenant demonstrates only that the login works. Read the last row carefully — it is the one that determines what your first few calls return.

So /accounts, /portfolios and /positions all return a populated book. Performance is the one that stays thin, because nothing is backdated — see Current limits.

Trial lifecycle

signup ──► PENDING_VERIFICATION ──verify──► ACTIVE ──30d──► EXPIRED ──15d──► PURGED
                                               │
                                               └── deal closed ──► CONVERTED

Conversion is a flag flip, not a rebuild. If you go ahead, the firm you explored becomes your live one — models, configuration, fee schedules and exploration history intact. Worth knowing before you decide how much configuration effort to invest during an evaluation.

Reset is authenticated with your own login rather than by email, because an endpoint that re-issued credentials to anyone who knew your address would be a takeover mechanism. Note what it does not do — see Current limits.

Capacity and fair use

This is a small, shared environment. The limits are real and they are published so you can design around them rather than discover them.

If signup returns 503 with a JSON body, the platform-wide ceiling is full — email us and we will make room, because that ceiling exists to keep the environment responsive rather than to ration access. A 503 with an HTML body is the edge rate limiter instead; back off and retry.

Sandbox activity never becomes a business figure. Sandbox portfolios are excluded from billing sweeps and from regulatory report generation, and sandbox events are tagged so downstream consumers can filter them.