Artha documentation

Overview & architecture

Artha is a personal market-analytics and trading terminal for Indian markets — NSE and BSE cash, plus F&O. It pairs a quantitative analytics engine with a dense, instrument-grade interface.

• Backend. A FastAPI service (Python 3.12) organized by domain — data, analysis, risk, options, portfolio, factors, optimization, backtesting, diversification, performance, fundamentals, regime, arbitrage, recommendations, margin, costs, trading, realtime and market data.
• Frontend. A Next.js (App Router) and TypeScript terminal UI styled with Tailwind and a token-driven theme system.
• Data layer. Free public market data by default, an optional Upstox Analytics Token for faster read-only quotes/candles/depth/options, and Zerodha Kite for live holdings, orders and execution.
• Multi-tenant & dual-mode. Paper analytics for every account; live data and execution context when a user connects their own Kite key.

Getting started

Open the terminal and sign in with an email and password. Accounts are created from the same screen — choose Create an account, set a password of at least six characters, and you are taken straight into the terminal.

Everything is available immediately on free public data. No broker connection is required to use portfolios, analytics, optimization, options analysis, backtesting or market internals.

Data sources & tiers

Artha works on three practical tiers. Public data powers the default analytics surface, a free Upstox Analytics Token improves read-only market data, and Zerodha Kite adds live account/order access.

The backend routes every market-data request through a provider router. When `QD_UPSTOX_ACCESS_TOKEN` is set on the backend, Upstox is tried first for supported symbols. Missing symbols fall through provider-by-provider, so mixed requests such as the Index Board can combine Upstox with yfinance or NSE instead of failing the whole batch.

Chart candles support 1m, 5m, 15m, 30m, 1h, 1d, 1w and 1M. Intermediate Upstox frames are aggregated server-side from the closest native feed.

Connecting Zerodha

Live F&O and real-time depth come from Zerodha Kite Connect, a paid subscription you hold directly with Zerodha. To connect:

• Open Settings and enter your Kite API key and API secret.
• Complete the Kite login flow to authorize the session.
• Artha exchanges the request token for a daily access token.

Kite access tokens expire daily, so the login step is repeated each trading day. Your API secret and access token are encrypted at rest and never returned to the browser (see Security & data handling).

Portfolios

You can maintain multiple portfolios and switch between them. The portfolio you select becomes the active portfolio, and every analytic — risk, diversification, optimization inputs, attribution — is scoped to it.

• Create, rename and delete portfolios.
• Add holdings with quantity and average cost.
• Analysis always reflects the currently active portfolio.

Optimization

The optimizer constructs target allocations from the active portfolio's universe using standard institutional methods.

• Methods. Mean-variance (Markowitz), Hierarchical Risk Parity (HRP) and Black-Litterman.
• Whole-share allocation. Targets are converted to whole-number share counts so the result is tradable in the Indian cash market.
• Efficient frontier. An interactive frontier shows the risk/return trade-off across feasible portfolios.
• Market scan. A scan suggests additions from outside the current holdings that could improve the optimized result.

Options & F&O analytics

A derivatives workbench spanning the chain and per-contract analytics.

• Option chain. Strikes, premiums and open interest across expiries.
• Greeks. Delta, gamma, theta, vega and rho per contract.
• Implied volatility. Computed by inverting the Black-Scholes model against observed premiums.
• Max-pain, OI & PCR. Max-pain strike, open-interest distribution and the put-call ratio.

Backtesting & strategy analysis

Strategy evaluation is built to resist the most common ways backtests overstate performance.

• Walk-forward. Parameters are fit on past windows and evaluated out-of-sample on the next.
• Purged cross-validation. Train/test folds are purged and embargoed to prevent look-ahead leakage from overlapping labels.
• Deflated Sharpe. The Sharpe ratio is discounted for the number of trials run, guarding against selection bias.

Market internals

Breadth measures that describe participation beneath the index level.

• Advance/decline line. Cumulative advancers minus decliners.
• McClellan oscillator / summation. EMA spread of net advances and its running sum.
• Zweig breadth thrust. A fast surge in the advancing-issues ratio off a low.
• % above SMA. Share of constituents trading above a moving average.
• New highs–lows. Net new 52-week highs versus lows.
• TRIN. The Arms index relating advance/decline counts to volume.
• Regime. A composite read classifying the prevailing market state.

News analytics

News analytics are fully algorithmic — there is no large language model in the loop. Each signal is computed from the news flow itself.

• TF-IDF themes. Term-frequency / inverse-document-frequency surfaces the distinctive topics in current coverage.
• Buzz z-score. Coverage volume standardized against its own history to flag unusual attention.
• Recency-weighted sentiment. A lexicon-based sentiment score that weights newer items more heavily.
• News-flow signal. A combined read of buzz and sentiment over the recent window.

Security & data handling

Artha handles portfolios, holdings and — for connected users — encrypted broker credentials. Controls are mapped to the OWASP API Security Top 10 and OWASP ASVS.

Authentication

Every request carries a Bearer token (a Supabase JWT). Signature, expiry and audience are verified on each request, with an algorithm allow-list that blocks alg=none and algorithm-confusion attacks. A development-only header bypass is honored solely in dev mode and is refused at startup in production.

Per-tenant isolation

Every persisted row carries an indexed user_id, and all queries are scoped by it. Resource endpoints verify ownership before any read, update or delete, returning 404 on a non-owned id so existence is not leaked.

Broker secrets at rest

Kite API secrets and access tokens are sealed with AES-256-GCM envelope encryption — a random 12-byte nonce per secret and authenticated ciphertext, decrypted only in memory at request time and never persisted in plaintext. The master key lives only in the environment; a non-dev boot using the insecure default key is refused at startup.

Transport & headers

TLS is terminated at the platform edge. Security headers set HSTS, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, a strict referrer policy, a locked-down content-security policy and Cache-Control: no-store on sensitive JSON. CORS uses an explicit, non-credentialed origin allow-list.

Rate limiting & injection

A per-client token-bucket rate limiter applies, with a stricter tier on credential and trading paths. All database access is parameterized and all request bodies are validated, so there is no string-built SQL.

Disclaimer

Artha is an educational and analytical tool. It does not provide investment advice, recommendations, or an offer or solicitation to buy or sell any security. Market data is sourced from third parties and may be delayed, incomplete or inaccurate. You are solely responsible for any decisions you make.