Credential encryption
Exchange API keys and managed wallet private keys are encrypted before they are written to the database, using authenticated encryption tied to a server-side key that never leaves our infrastructure. They are never returned in any API response.
Trade-only access, always
We validate that connected exchange API keys do not carry withdrawal permissions. Where the exchange allows it, we also recommend IP-restricting your key for an extra layer of protection.
- Withdrawal-capable keys are rejected at connection time where the exchange API exposes that permission.
- Wallet connections for DeFi mode share only your public address — never a private key or seed phrase — unless you opt into managed smart-account mode, where the key is generated and encrypted on our side specifically for that purpose.
Continuous monitoring
Automated jobs reconcile every exchange position against our records on a short interval and flag anything that drifts out of sync, so a stuck or duplicated order gets caught quickly rather than silently compounding.