Funds remain at your exchange
We never take custody. Your balance sits in your own exchange account, under your name, at all times.
No withdrawal permission
The system only needs read access and spot trading. Connections that carry withdrawal rights are refused at setup.
Encrypted credentials
API credentials are encrypted before storage with a key held outside the database. Secrets are never logged and never returned to the browser.
Server-side execution
All strategy logic runs on private infrastructure. Nothing about the strategy is delivered to your browser.
Revoke at any time
Delete the API key at your exchange, or disconnect here, and execution stops immediately.
Permissions to set on your API key
Create an API key with Read + Spot Trading permissions only. Withdrawal permissions must remain disabled.