Security

How keys, sessions and data are protected.

API keys

Binance keys are encrypted with AES-256-GCM before storage, never logged and never returned to a browser. Withdrawal permission is never needed.

Sessions

Sign-in is Thundera single sign-on (auth.thundera.eu). Access tokens are short-lived JWTs in an HttpOnly cookie; refresh is handled once per burst and only an explicit rejection ends the session. State-changing requests are origin-checked.

Protected pages

/app and /system stay hidden until your session is confirmed, so signed-out visitors never see the workspace structure. Per-user local storage is cleared when a different user signs in on the same browser.

Audit trail

Each bot decision records indicators, conditions, market state and reasoning. AI interactions go to an immutable audit log; your chat history can be cleared independently.

Shared trading intelligence

AiTrade learns from anonymized, aggregated statistics about setup types and outcomes. Your identity, bots, individual trades, balances and keys are never shared, and aggregates appear only after enough independent users contribute (k-anonymity).