Security and custody

Where the keys live.

• The house wallet's key is on our internet-connected server, readable only by the signing process's own system user. Not a hardware wallet, not a multisig.
• The trading server cannot sign. The signer is a separate process with its own limits, which the trading server cannot raise: 100 USDC per withdrawal, 250 per wallet per day, 1,000 a day overall (signer defaults, 2026-10-19). It pays each account only to the wallet it first paid.
• Anything above those limits needs an approval signed by a key kept off the server.
• The owner's hardware wallet seeded the pool and is the only address an emergency sweep can send to.

Two people. Releasing money or raising risk (approving a held withdrawal, raising a limit, lifting a freeze, a sweep) needs the operator and the owner. Lowering risk (a freeze, a pause, a lower limit) happens at once.

Watching. The ledger is reconciled against the house wallet on chain, and any mismatch stops opens and withdrawals by itself. Alerts run every 5 minutes; each gets a reply within the hour (owner, 2026-10-19).

Backups. The Trade ledger is copied continuously on the server and mirrored to another provider every 15 minutes, with nightly off-site copies and a restore drill every Sunday (backup schedule, 2026-10-19). Encrypting the off-site copy is still on the list.

What is not covered. No insurance, no compensation scheme, no external audit, no bug bounty yet: internal reviews only. No identity checks. Use only money you can afford to lose; the risks page lists the rest.