Security model

• Delivered on your servers — we never custody keys or funds.
• API keys with trading only, no withdrawals, IP allow-listed.
• Isolated signer with spend caps, allow-lists and a kill switch.
• This site: static, no database, strict CSP, HSTS preload, DNSSEC.