Security & Protection
Multi-layered security system with advanced encryption, JWT authentication, Role-Based Access Control (RBAC), rate limiting, and continuous monitoring. Your data security is our priority.
Security Pillars
Encryption & Key Management
Fernet (AES-128) encryption for API keys, TLS 1.2+ for data transmission, API keys are decrypted in memory and never stored as plaintext. KMS system with 32-byte base64 key.
Rate Limiting & Network Protection
Smart Rate Limiter for Exchange APIs (10 req/s per user for XT, 2 req/s for Bybit), Anti-Abuse System with ban mechanism, CORS protection, and SQL Injection prevention with SQLAlchemy ORM.
Monitoring & Incident Response
Centralized logging system, automatic abuse detection, instant notifications to admins, and tracking of all user activities and devices.
Account Security
JWT with Access/Refresh Token rotation, Session management with database, Device tracking, Password hashing with bcrypt, and Cloudflare Turnstile for bot protection.
Access Control & Validation
RBAC (Role-Based Access Control) with roles and permissions, Input validation with Pydantic schemas, Token revocation with blocklist, and Role-based middleware protection.
Session Management & Authentication
Token sliding renewal (auto-refresh near expiration), Session expiration management, Stale token detection, and Role consistency validation on every request.
Our Security Process
Secure Design from the Start
Multi-layered security architecture: JWT with rotation, RBAC middleware, Encryption layer for sensitive data, and Input validation on all endpoints.
Secure & Type-Safe Code
TypeScript in frontend, Pydantic validation in backend, SQLAlchemy ORM to prevent SQL Injection, and continuous Dependency scanning.
Runtime Protection
Smart rate limiting, Anti-abuse detection, Token revocation, Session management, and continuous Monitoring with automatic alerting.
Implemented Security Features
All these features are implemented in the system code and are actively running.
Security FAQ
Do you have access to exchange funds?
No. We work through APIs with limited permissions; fund withdrawals are disabled by default unless you explicitly enable them. Our system can only execute trades and access your balance, but cannot transfer funds without your permission.
Where are my API keys stored?
Your API keys are encrypted using Fernet (AES-128) encryption and stored in the database. The main KMS key is kept in an environment variable and never stored in the database. Keys are only decrypted in memory when needed and are never displayed as plaintext in logs or API responses.
How can I make my account more secure?
Use a strong password (at least 8 characters with a combination of uppercase/lowercase letters, numbers, and special characters), change your API keys periodically, only enable necessary permissions for API keys (usually only Trading and without Withdrawal), and use Cloudflare Turnstile which is active in our system for bot protection.
How does the authentication system work?
We use JWT (JSON Web Token) with HS256 algorithm. Access Token with 15-minute validity and Refresh Token with 7-30 day validity are issued. Token rotation is done automatically and old tokens are placed in a blocklist. Session management is done with the database and all active devices are tracked.
How does the Rate Limiting system protect me?
Smart Rate Limiter applies separate limits for each exchange (e.g., 10 requests per second for XT, 2 requests per second for Bybit). Anti-Abuse System temporarily bans users in case of abuse and notifies admins. This system prevents overload of exchange APIs.
How does Access Control (RBAC) work?
Our system uses Role-Based Access Control. Roles (user, admin, super_admin) and precise permissions are defined for each endpoint. Middleware automatically checks the user's role and permissions on every request and rejects the request if access is denied.
