Public website
A fast static site on Cloudflare Pages with live market cards, analysis articles, a learning section and clear risk language.
Case study · In-house product
XAU Setups: from chart alert to phone, automatically.
We designed, built and operate XAU Setups end to end: the indicators that watch the market, the server that turns alerts into plans, the bot that delivers them, the checkout that grants access, and a public record that shows every outcome.
What you can hire us for: production platforms that connect real-time data, payments, automation and customer access.
- Type
- In-house product, not client work
- Status
- Live since October 2026
- Our role
- Product, design, engineering, operations
- Delivery
- Web, Telegram, member area
Built with
PineScript indicatorsPHP8 + MySQLUbuntuon DigitalOceanCloudflarePagesTelegramBot APINOWPaymentscrypto checkoutCronscheduled jobs
01 / The problem
Fast markets, slow tools, and records nobody can check.
What the product had to fix for a retail gold trader.
Gold can move 20 dollars in minutes. Traders who follow a rule-based method usually stare at charts all day, copy levels by hand into a chat, and lose the moment. When a service sends plans, the history is often a screenshot gallery that hides the losing trades.
We wanted a product that does the watching, sends a complete plan (entry, stop and target) the moment the rules confirm one, and keeps a public record of every outcome, losses included.
- 01Plans must arrive in seconds, not minutes, on the phone the trader already uses.
- 02The method stays private; the results stay public.
- 03No new plans around high-impact news.
- 04Paying for access must unlock it automatically, with no manual steps.
- 05The public site must stay up even when the back end is busy.
02 / What we built
One product, eight working parts.
Each part is live and used every day.
Data pipeline
TradingView alerts from our own indicators post price and structure events to a webhook on our server, which stores the data for the engine and for later research.
Strategy engine
Several independent rule systems, shown publicly only by codename, turn events into plans with entry, stop and target, then track each plan until it settles.
News shield
An economic-calendar feed pauses new plans around high-impact US releases and handles open plans by fixed rules.
Telegram delivery
A bot posts each plan as it happens: pending, active and closed, each tagged with the system that produced it.
Public record
Every published plan, with its levels and outcome in pips, straight from the feed. No statistics are shown until the sample is meaningful.
Crypto checkout
NOWPayments invoices with signed callbacks: a confirmed payment unlocks the member plan automatically.
Member and admin panels
Members manage their access; the admin panel can review plans and step in by hand when the market demands it.
03 / Architecture
From chart alert to phone, in one pass.
The live data path. Dots show the direction of flow.
Market data and plansPayments and access
1 · Pending
Rules confirm a setup. The plan is stored and sent at once with entry, stop and target.
2 · Active
Price reaches the entry. Members get a second message; the record shows the plan as live.
3 · Closed
Target, stop, breakeven or cancellation. The outcome in pips is written to the public record.
04 / Screens
The real product, captured from the live site.
Captured from the live site in November 2026. Select a screen to enlarge it.
05 / Admin and safeguards
The private side, built as carefully as the public one.
Implemented in the product. Not an independent security audit.
- Hardened sign-inHashed passwords, a one-time code step, session renewal on sign-in and a 15-minute lock after repeated failures.
- Protected admin actionsEvery form that changes data carries an anti-forgery token.
- Audit logAdmin and system actions are recorded with sensitive values hidden.
- Verified paymentsAccess changes only after the payment provider's signed callback checks out.
- Test modeThe whole flow can run with Telegram posting switched off, so changes are tried before members see them.
- Defensive webhook inputPayloads are validated and normalised before they reach the engine.
These safeguards are part of the code we ship. We have not commissioned a third-party penetration test for this product.
06 / Engineering decisions
The details that make it trustworthy.
Choices a buyer can ask us about.
Method private, results public
The site, the bot and the record show only a system codename and the trade levels. Rule internals never leave the server, yet the outcome of every published plan goes on the record.
Treat every webhook as untrusted
Alerts can arrive late or with fields swapped. The endpoint validates each payload and normalises values, for example zone bounds sent in the wrong order, before the engine sees it.
Static front, dynamic core
The public site is static on Cloudflare Pages and reads one small JSON endpoint. If the server is busy, the site still loads and says so instead of showing stale numbers.
Access that grants itself
Payment callbacks are verified before access changes. No one has to read a screenshot of a transfer and switch a member on by hand.
News handled by rules, not by mood
A calendar job keeps upcoming high-impact events in the database. The engine checks it before filling or settling anything during volatile minutes.
Honest by default
Educational wording, a risk disclosure on every page, and no win rate until enough plans have finished. Credibility is a feature we built on purpose.
07 / Timeline
Rebuilt and relaunched in one week.
On top of an engine we had been developing and testing since September 2026.
Engine and indicators
Rule systems, plan lifecycle, news shield and Telegram delivery developed and run on a previous brand.
New brand, new infrastructure
Name, domain and identity chosen; Ubuntu server on DigitalOcean; public site on Cloudflare Pages.
Data and record go live
TradingView alerts flowing into the new server; homepage design approved; the public record starts.
Product complete
Member and admin panels, crypto checkout and Telegram delivery connected end to end.
Content layer
Weekly multi-timeframe analysis and a Learn section added, with the menus focused on one paid plan.
08 / What it shows
What this project proves for your build.
The same skills, applied to your product.
- Real-time integrations: webhooks in, bots and APIs out
- Payments that change account state safely
- A public site and a private core that fail independently
- Telegram bots that carry real business messages
- Data presented honestly, with live status
- One team covering design, engineering and operations
How we would run your build: a free call, then a written scope with a fixed price or monthly rate, weekly progress updates, independent QA before launch, and a full handover of code, documentation and access. See how we work →
XAU Setups is an in-house product designed, built and operated by Arcvane Labs. It is not commissioned client work, and we show no user or revenue figures. The product is educational; trading involves risk. Screens were captured from the live site.
Next case studyClearLayer Access →