Security

Plain description of what we do with your exchange keys and your data. If anything here is unclear, ask: [email protected].

Exchange keys

Read-only, enforced. When you connect, we ask the exchange what the key is allowed to do. A key with trading or withdrawal permission is refused and not stored. On Binance, futures keys cannot be made read-only, so we require withdrawals and spot trading to be off and recommend IP restriction.
Encrypted at rest with a server-side key (Fernet, AES-128-CBC + HMAC) that lives only in the server's environment, never in the database or in backups of the database.
Displayed as the last 4 characters only. The full key is decrypted in memory for the duration of a sync and nowhere else. Raw exchange payloads are redacted before being stored.
Deleting a connection deletes the key and every fill and trade imported through it.

Passwords are hashed with bcrypt. Login attempts are rate-limited per address and account.
Sessions are signed cookies (SameSite=Lax, Secure, HttpOnly). "Log out everywhere" invalidates them all instantly.
Cross-site request forgery is blocked at the middleware level; responses carry a strict Content-Security-Policy, HSTS and the usual hardening headers.

Hosted in the European Union. HTTPS only. Encrypted, off-server backups every night; the key encryption key is not part of them.
Payments are processed by Lemon Squeezy. We never see or store card numbers.
No third-party analytics, tracking scripts or CDNs: every script is served from this domain.

Export all your data as JSON, or delete your account and everything with it, from the Account page. No email needed, no waiting.

Write to [email protected]. We answer, we fix, we credit you if you want.