Security
We can trade for you. We can never move your money.
That is not a policy we promise to follow — it is what the exchange itself enforces. The API key you connect has withdrawal permission disabled, so pulling funds out is impossible for us, and for anyone who somehow obtained the key.
No custody
We never hold a cent. Your capital lives on your exchange — always.
No withdrawal access
API keys are read + trade only. Pulling your funds is impossible for us.
Revoke in one click
Kill the connection any time. The keys are yours, not ours.
Paper mode before live
Trade on a virtual account first — real execution, zero capital at risk.
AI tunes configs, not advice
The AI optimizes parameters. It never gives financial advice or predicts the market.
Risk controls on by default
Drawdown caps, liquidation guards and auto-hedge ship armed, not optional.
How your API keys are stored
Encrypted before they touch the database
Every key and secret is encrypted with AES-256-GCM. The encryption key lives in a server environment variable kept separate from the database — a copy of the database alone decrypts nothing.
Server-side only, never in the browser
Keys are decrypted in memory on our servers only when a system needs to place an order. The web app never displays a secret back to you after you save it.
Checked on connection where the exchange allows
Where an exchange exposes key permissions programmatically, we reject keys that still have withdrawals enabled. Where it does not, we ask you to confirm before saving.
Deleted means gone
Removing a key stops the systems that use it and erases the stored record. You can also revoke the key on the exchange at any moment — nothing on our side can prevent that.
What we use the key for
- Read your balance and open positions
- Place entry and exit orders according to your system
- Set take-profit and stop-loss orders
- Cancel or modify orders, and read market data
What we never do
- Withdraw or transfer funds — the permission is off at the exchange
- Accept deposits or hold a balance for you
- Share keys with third parties or send them to the browser
- Trade on our own behalf using your key
Protecting the account itself
Two-factor authentication
TOTP via Google Authenticator, Authy or 1Password, with ten one-time backup codes shown once and stored only as hashes.
Session control
See where the account is signed in and revoke every other session in one action.
Rate-limited authentication
Sign-in and password-reset attempts are throttled, so a stolen password cannot be brute-forced at speed.
The full policies
Everything above is stated in the documents in binding language — including what happens if we are ever compromised.
Start on paper. No key needed.
Paper trading runs on a virtual balance and requires no exchange connection at all — connect a key only when you decide to.