The engines are real. So are the prices.

The rebalancing engine, drift calculation, performance math, tax-lot accounting and tax-loss-harvesting logic you exercise here are the production code paths — the actual software, not a walkthrough — and the securities you hold are priced by the real market data feed.

That split is deliberate and it is the point of the environment. You are evaluating whether the numbers are right, and synthetic prices would make that impossible to judge. What is simulated is everything downstream of a trading decision: fills, custody, settlement and identity verification.

What is real and what is simulated

The boundary is enforced on your tenant, not on the platform

Your tenant's order flow is pinned to the local simulator and to native custody. An account flagged as sandbox cannot dispatch to an external custodian integration, and a request for a correspondent custodian is refused with a 403 naming the constraint — not quietly downgraded. The rule lives in one module every custody-touching path consults, and it keys off the account's own flag — not an environment variable a deploy could flip. Refusing rather than downgrading is a correction. Keeping the requested custodian label while forcing native custody underneath produced accounts labelled DRIVEWEALTH that were not at DriveWealth, and a disclosure screen telling a prospect their SSN had gone to a custodian that never received it.

Precisely: your tenant cannot reach an external custodian. Interpose's own integration testing does run vendor UAT traffic on the same infrastructure, and the isolation between it and your tenant is the same rep-code scoping every firm on the platform runs on.

Your tenant and your seeded book

firm         SBX{n}              flagged is_sandbox
  └── branch MAIN
        └── rep code SBX{n}R01
              └── portal user   role = advisor, scoped to that rep code

You are an ordinary advisor to every service on the platform. The alternative — inventing a sandbox role — would have meant auditing roughly 1,265 endpoints across nine services and remembering the new branch in every endpoint written afterwards, which is precisely the shape of failure that produces cross-tenant leaks.

Provisioning creates a book, because an empty tenant demonstrates only that the login works. Read the last row carefully — it is the one that determines what your first few calls return.

So /accounts, /portfolios and /positions all return a populated book — and because the trading is backdated, so do performance, realised gains and the tax-lot endpoints. What the history is not is yours; see Current limits.

Trial lifecycle

signup ──► PENDING_VERIFICATION ──verify──► ACTIVE ──30d──► EXPIRED ──15d──► PURGED
                                               │
                                               └── deal closed ──► CONVERTED

Conversion keeps your setup and leaves the demo book. If you go ahead, the firm you explored becomes your live one — its name and branding, your team's logins, the models and strategies you built with their fee schedules, workflow templates and trade parameters. The seeded clients, accounts and three years of history stay behind: they are fictional, and none of it ever becomes a live book. API keys minted during the trial are replaced with new ones. Configuration effort during an evaluation is not wasted.

Reset is authenticated with your own login rather than by email, because an endpoint that re-issued credentials to anyone who knew your address would be a takeover mechanism. Note what it does not do — see Current limits.

Capacity and fair use

This is a small, shared environment. The limits are real and they are published so you can design around them rather than discover them.

If signup returns 503 with a JSON body, the platform-wide ceiling is full — email us and we will make room, because that ceiling exists to keep the environment responsive rather than to ration access. A 503 with an HTML body is the edge rate limiter instead; back off and retry.

Sandbox activity never becomes a business figure. Precisely: sandbox portfolios are excluded from billing sweeps (no statement is ever generated — the skip is counted and shown, not silent), sandbox accounts are excluded from GIPS composite membership, sandbox events skip autonomous agent dispatch, and every event a sandbox tenant produces carries an issandbox CloudEvents extension so downstream consumers can filter it. Nothing in a sandbox tenant touches DTCC, a custodian, a transfer agent or a tax form, because none of those integrations are reachable from a sandbox account at all.