Security & Trust

Your API keys are sensitive. Here's exactly how we protect them—and why you can trust us with them.

---

The Most Important Thing

TokenBot cannot withdraw your funds. Ever.

When you create API keys for TokenBot, you only enable "trade" permissions. Withdrawal permissions stay OFF. Even if someone stole your API key from us (which our security prevents), they couldn't move your money.

Your funds stay on your exchange, under your control.

---

How We Protect Your API Keys

Encryption at Rest

Your API keys are encrypted using 256-bit AES encryption before being stored. This is the same standard used by banks and governments.

Even if someone accessed our database, they'd see encrypted gibberish—not your actual keys.

Encryption in Transit

All communication between your browser and TokenBot uses TLS 1.3 encryption. Data traveling over the internet is protected from interception.

Secure Infrastructure

TokenBot runs on AWS (Amazon Web Services) with:

• Encrypted storage volumes

• Private network isolation

• Regular security patches

• Multi-region redundancy

No Human Access

Our staff cannot see your raw API keys. The encryption happens automatically, and we don't have the ability to decrypt them for viewing.

---

What API Keys Can and Cannot Do

When you create API keys, you choose their permissions. Here's what TokenBot needs:

Required Permissions

Permission	Why We Need It
Read	See your open orders and positions
Trade	Place buy and sell orders

NOT Required (Keep These OFF)

Permission	Why OFF
Withdraw	TokenBot never needs to move your funds
Transfer	No need to move between accounts
Futures (sometimes)	Only if you trade futures

---

Best Practices for API Keys

Follow these guidelines to maximize security:

1. Never Enable Withdrawal

Even though TokenBot doesn't need it, some people enable all permissions by default. Don't. Always keep withdrawal OFF.

2. Use IP Whitelisting (When Available)

Many exchanges let you restrict API keys to specific IP addresses. If you know TokenBot's IP range (we can provide it), whitelist only those IPs.

3. Create Dedicated Keys

Don't reuse API keys across services. Create a separate key specifically for TokenBot. If you ever want to revoke access, you can delete just that key.

4. Rotate Keys Periodically

Every few months, create new keys and update them in TokenBot. Delete the old keys on your exchange. This limits exposure if old keys were compromised.

5. Use Strong Exchange Security

• Enable 2FA on your exchange account

• Use a unique, strong password

• Check login history regularly

---

What Happens If We Get Hacked?

Let's address the worst-case scenario directly.

If TokenBot were breached:

1. Attackers would find encrypted API keys (useless without decryption keys)

2. Even if decrypted, keys cannot withdraw funds

3. We'd detect the breach and notify all users immediately

4. You could revoke your API keys on each exchange in minutes

Bottom line: Even a breach couldn't result in stolen funds.

---

You're Always in Control

Revoking Access

Want to stop using TokenBot? Here's how to fully disconnect:

1. Log into each exchange

2. Go to API management

3. Delete the keys you gave to TokenBot

That's it. The keys stop working immediately. TokenBot can no longer interact with your account.

Deleting Your Account

When you delete your TokenBot account:

• All your API keys are permanently deleted from our systems

• Your trading history is removed

• Your personal information is erased

We don't keep your data after you leave.

---

Our Security Practices

Regular Audits

We conduct security audits to identify and fix vulnerabilities before they can be exploited.

Penetration Testing

External security researchers test our systems, trying to find weaknesses. We fix anything they find.

Bug Bounty Program

Security researchers who discover vulnerabilities can report them responsibly and receive recognition.

Incident Response

We have documented procedures for responding to security incidents, including immediate user notification.

---

Comparing Security Models

Model	Fund Safety	Example
Custody (they hold funds)	⚠️ Platform can lose/steal	FTX, Mt. Gox
Smart contract	⚠️ Contract bugs = lost funds	Various DeFi hacks
API key (no withdraw)	✅ Funds stay on exchange	TokenBot

TokenBot's model is the safest because we never have access to move your money.

---

Frequently Asked Questions

Can TokenBot staff see my trades?

Our systems can see trade data (to copy them), but individual staff members don't have dashboards showing your activity. Data access is logged and restricted.

What if an exchange gets hacked?

That's on the exchange, not TokenBot. We recommend spreading funds across multiple exchanges—which TokenBot makes easy to manage.

Is my personal information secure?

Yes. We store minimal personal data, all encrypted. We never sell data to third parties.

How do I report a security issue?

Email [email protected]. We take all reports seriously and respond promptly.

---

Summary

Concern	Answer
Can TokenBot withdraw my money?	No
Are my API keys encrypted?	Yes, 256-bit AES
Can staff see my keys?	No
Can I revoke access instantly?	Yes, delete keys on exchange
What if TokenBot gets hacked?	Keys are encrypted, can't withdraw anyway

---

Next Steps

Feel confident about security?

Get started with TokenBot →

Still have questions?

Join our Discord for support →