Security
This page is written for someone who has never read technical documentation. It explains what the system can do, what it cannot do, and why the second list is the one that matters.
In plain words
Four notions to know, and nothing more
Private key and recovery phrase
The secret that controls a wallet. Whoever has it controls the funds, permanently. Yours never leave your side: we never ask for them, no field of the application can receive them, and none of our staff is allowed to read one, even if you offered it.
Signing
Authorising an operation. It is the one act that makes something irreversible. In SEMI-AUTO it is always you doing it. In FULL AUTO the agent can only commit what the signed envelope expressly allows, and nothing else.
Policy envelope
The document you sign to give the agent work: cap per operation, cap per day, cumulative budget, allowed chains and contracts, expiry date. It reads the way it is written: whatever is not in it is forbidden.
Revocation
The withdrawal of the granted authority. One click, immediate effect, no permission to ask, no notice to give. Expiry does the same thing on its own, at the date you fixed when signing.
Separation
Your wallet and the agent’s authority: two things that never blur
Ownership cannot be delegated; work can. The whole security of the product rests on that distinction.
Ownership: your keys, your wallet
The wallet is yours, created or connected by you. You receive there what the fleet collects, you withdraw whatever you want, whenever you want, without our consent. We only know its public address, the one you would give anyone sending you funds.
The authority of use: written, capped, mortal
The agent receives the right to act inside a signed envelope: caps per operation and per day, a cumulative budget, named contracts and chains, an end date. That authority cannot be transferred, cannot widen itself, dies at expiry or revocation, and never becomes ownership.
What this prevents
- An operation exceeding what you signed: the cap is checked at proposal and checked again at signing, and two simultaneous operations cannot consume the same envelope balance twice.
- Anyone on our side moving your funds: there is no key, no procedure and no exceptional access that would allow it.
- An automatic mode surviving your decision to stop it: the full stop withdraws the authority immediately and returns the account to SEMI-AUTO.
- An error staying invisible: every execution and every refusal leaves a timestamped, exportable receipt with its reason.
We hold no key, and no mechanism, no contract and no assistance procedure exists that would let us reach your wallet. So nobody on our side can take those funds from you, nor give them back if you lost your access. The same property, read in both directions.
Architecture
Why we cannot touch your funds
There is no technical path between our systems and the ownership of your assets. An internal policy can change on a Friday evening; an architecture cannot.
- No key is generated, held, backed up or reconstructible on our side, for any wallet, including those created from an e-mail, whose key is born and lives on your browser side.
- No funds ever pass through us: what the fleet collects lands directly on your address, and the only financial flow between you and us is the subscription price.
- The policy envelope exists only by your signature: we can neither create it, nor widen it, nor extend it, nor reactivate it after revocation.
- Withdrawing your funds depends on no button of ours: your wallet answers to your keys, not to our availability.
- The direct consequence, in both directions: if the service shut down for good, your assets would be strictly unchanged; and if you lost your access, we could do nothing for you.
Before every operation
Pre-signature checks, in both modes
The same set of checks runs before any signature. What changes between the modes is who decides in case of doubt, and the answer always goes against execution.
What is checked: the contract called is the one that was analysed (code fingerprint compared), the approvals created are the ones planned, the simulation of the outcome matches what is announced, and the envelope covers the operation.
In SEMI-AUTO: the list is presented to you with the transaction (full address, amounts in plain sight) and nothing leaves without your signature.
In FULL AUTO: the same checks become blocking, and an unknown value means refusal. With no human to warn, doubt never gets the benefit of the doubt.
These checks reduce known risks; they do not certify a contract. That is an honest limit, not an implementation detail.
What the system can and cannot do, technically
The right-hand column is the one protecting you. No option, no plan and no commercial agreement changes it.
What the service can do
- Read public data: the chain, protocol documentation, platform terms, and the addresses you declared.
- Search, analyse, qualify, refuse, and keep the trace of all of it, including its refusals.
- Execute operations from your wallet, only inside the limits of the envelope you signed, and only in FULL AUTO mode.
- Present you a prepared transaction and wait for your signature, in SEMI-AUTO mode.
- Collect the proceeds of missions directly to your address, never anywhere else.
- Suspend itself immediately, in part or in full, when you ask.
What the service cannot do
- Exceed a cap, a chain, a contract or a date of the envelope, or widen that envelope without a fresh signature from your hand.
- Hold, see or reconstruct a private key or a recovery phrase.
- Move your funds to an address that is not yours, block a withdrawal, or freeze anything.
- Circumvent a KYC, a proof of humanity or a CAPTCHA: the step is prepared and presented to you, never faked.
- Give you back a lost access, or reconstruct a mislaid recovery phrase.
These limits are verified at every release by acceptance tests, not merely written on this page.
Interruption
You can stop everything, in one click
Two degrees, reachable from the home screen of your space. The safe direction never costs anything: pausing asks for no confirmation and no second factor.
- Pause suspends analyses, executions and notifications. Everything is kept as it is, and resuming puts the account back where it was.
- The full stop also withdraws the delegated authority: the envelope stops being usable and the account returns to SEMI-AUTO. Granting it again takes a fresh decision from you, never a silent resumption.
- What is never cut, at any degree and for any reason: the full export of your data, the revocation of your sessions and access, the use of your wallet, and your cancellation.
- Reactivation requires strong confirmation: resuming activity is a more sensitive act than stopping it.
Data
What we keep, and what we refuse to do
A wallet address is personal data: tied to your account, it identifies you, and the history that follows from it says a lot. We treat it accordingly.
- No address ever appears in a URL, a campaign parameter, a page title or an e-mail subject.
- No address is passed to any third-party analytics, testing, support or marketing tool. The site calls no third-party domain: no external font, no analytics script, no CDN.
- Technical logs contain only an internal identifier and a truncated IP address.
- We never cross-match the addresses of two different customers, we neither sell nor share data with commercial third parties, and we train no model on identifiable customer data.
- You can detach an address at any time without deleting your account; the link is erased.
- Every piece of data has a declared retention period in the privacy policy, and deletion is tested across the whole chain: database, replicas, exports, backups, processors.
Account
Protecting your account
Your account gives access to the piloting of the fleet and to the history, not to your funds. It still deserves real protection: the dials, the caps and the mode are set from it.
- A second factor is mandatory. The passkey is recommended: your browser refuses to answer a domain that is not ours, which neutralises fake sites.
- SMS is never a primary factor: a number can be reassigned to someone else, and codes follow the number, not the person.
- Passwords are checked against known public breaches without the password leaving our servers, and we impose neither special characters nor periodic changes: those rules produce weaker passwords.
- Sensitive actions (attaching a wallet, switching to FULL AUTO, widening a cap, changing a payment method, exporting) require strong confirmation, sometimes a delay during which you can cancel everything.
- Your open sessions are listed and revocable one by one.
Three rules that protect you better than we can
Most losses exploit no technical flaw: they exploit a moment of inattention. These three habits are worth more than any feature.
- We will never ask for your recovery phrase or a private key, through any channel, for any reason. A message doing so in our name is a theft attempt.
- We will never send bank details or a deposit address by e-mail or messaging. That information only appears inside your authenticated space.
- We will never rush you. No timer, no limited seats, no closing window: if someone pressures you in our name, it is not us.
Risk information
Read this before any decision. This information is part of the service itself.
- Risk of total loss: crypto-assets are extremely volatile. You can lose the entire amount you commit.
- Illiquidity: some positions cannot be sold or withdrawn when you want to, sometimes never.
- No guarantee of result: the software searches, qualifies, verifies and tracks. No protocol commits to distributing anything, and past activity creates no entitlement. No gain, no yield and no future performance is promised.
- No insured deposit: we neither receive nor hold your funds, and no amount is covered by any deposit protection scheme. Paying a software subscription is not a deposit.
- Fees: network fees, platform fees, price spreads and conversion costs add up and reduce any result.
- Taxation: reporting and paying taxes is your responsibility, according to your country of residence. We provide no tax advice.
- Exact scope: the agents search, qualify, verify, prepare, track, and only act inside the mode you chose. In SEMI-AUTO (assisted) you sign every operation yourself; in FULL AUTO (delegated) the agent acts only inside the envelope you signed (caps, duration, immediate revocation), once that mode is open and activated. The service receives only public addresses and holds no key.
- Non-custodial: you are the sole holder of your keys. The app never asks for your recovery phrase and has no field able to receive one.
- Separation of roles: a separate agent wallet, whose key only you hold, carries the activity on a short budget, away from the wallet that receives. That separation bounds in advance what can be reached if an operation goes wrong.
- No recovery by us: because we hold none of your keys, we cannot move your funds, and we cannot give them back to you either. Backing up your recovery phrase is yours alone.
- We sell software. We do not manage your money and give no personalised investment advice. The agent never owns your assets: at most it holds an authority of use bounded by the envelope you sign, which you can revoke at any time.
- Conflicts of interest: we may receive affiliate compensation on software subscriptions taken out or referred. It never applies to your capital and never influences a qualification or a security refusal.
- The budget you declare is not a plan, not a deposit with us and not a promise of gain: it only calibrates your limits, your alerts and your risk scenarios. The funds stay on your own wallet.
Start by watching the fleet work.
The public demonstration runs on sample data, no account needed. The account itself opens after the first payment: quarterly by default, fully refundable for 14 days, cancellable in two clicks.