01Non-custodial
You hold the keys
You connect a wallet you control. There is no mode of this product in which we take custody of your assets, and no upgrade path that introduces one.
Custody
The single most important thing on this page.
Most of what goes wrong in this category goes wrong because somebody else was holding the assets. So we do not.
02Revocable
Disconnect whenever
Removing a wallet's authority is one action in the console and takes effect immediately. You do not have to ask us, and there is no notice period.
03No withdrawal
It cannot move funds out
The agent's authority is to trade inside your limits. It has no route to send your assets anywhere, including to us.
Limits
Enforced by the system, not by the agent's judgement.
An autonomous trader that respects its limits voluntarily is one bug away from not respecting them. Every boundary here is checked before capital moves, outside the code that wants to trade.
Position ceiling01
Checked before each commitment, across the whole fleet.
Daily loss floor02
Reaching it ends the day. The agent cannot vote to continue.
Slippage tolerance03
A fill outside your tolerance is refused, not accepted and explained.
Concurrency cap04
How much may be in flight at once, however many agents are live.
No self-widening05
There is no code path by which the agent raises its own ceiling.
The stop
One control, and it always works.
The stop is the control you will care about most on the worst day, so it is the one with the fewest moving parts.
Immediate
Effect
Not queued, not scheduled, not subject to a confirmation flow.
Everything
Scope
Every agent and every swarm, not the one you were looking at.
Any device
Reach
Phone, laptop, anywhere you can open the console.
Recorded
Evidence
Who stopped it and when, written to your record.
Assurance
How the platform itself is protected.
Custody is the big risk. These are the ordinary ones, handled the ordinary way.
01Secrets
No credentials in the product
Signing material is held in environment configuration, never in source. There are no default passwords and no fallback keys — a missing secret stops the service rather than quietly using a published one.
02Isolation
Your data is yours alone
Account data is scoped per account at the database level, so a query that forgot its filter returns nothing rather than somebody else's activity.
03Transport
Signed instructions
Internal instructions between our own services are signed over their exact contents, so a message that was altered in flight is refused rather than acted on.
04Identity
Federated sign-in
Identity can be federated through your organisation's provider, so joiners and leavers are handled where that already happens.
05Access
Least privilege
Viewing, operating and administering are separate rights. The administration console is not reachable from the member app at all.
06Keys
Scoped API credentials
Machine credentials are named, scoped and individually revocable, and every use is logged against the key that made it.
Failure
When something breaks, it stops trading.
The dangerous failure for an automated trader is not an outage. It is continuing to act on information that has gone stale — which looks exactly like working normally until the losses arrive.
01
Uncertainty resolves to inaction
If the agent cannot confirm the state of the market or of your limits, it does nothing. Doing nothing is always available and never wrong by more than an opportunity.
02
Stale means stop
An agent that has not reported in is stood down rather than assumed healthy. We would rather tell you it stopped than tell you it is fine without knowing.
03
Interruptions are recorded
Outages and degradations land on your record like everything else, so what happened during one is a fact rather than a reconstruction.
Privacy
Your activity is not a product input.
We do not sell your activity, we do not trade against it, and we do not aggregate it into a signal for anyone else. Your record exists so that you can read it and take it with you.
- Your trading activity is visible to you and to nobody else.
- We do not take positions against our users.
- Your record exports cleanly, whenever you want it.
- Deleting your account removes your data, not just your access.
Candour
What this page does not claim.
Security pages in this category tend to imply more than they say. These are the things we are not telling you.
—
Not that you cannot lose money
This is trading. It loses sometimes. The loss floor bounds how much in a day; it does not make losses impossible.
—
Not that nothing can go wrong
Software has bugs and markets have conditions nobody modelled. What we can tell you is how the system behaves when it is uncertain: it stops.
—
Not that we are audited
Where we hold a certification we will name it and show you the report. Until then we would rather say nothing than imply one.
Keep your keys. Keep the stop.
Connect a wallet you control and set limits the agent cannot widen. Everything else is its job.
Non-custodial. Stoppable at any moment. Trading involves risk of loss.