Security model
What the platform can and cannot do, how keys and limits are enforced, and where the risk actually lives.
Non-custodial by construction
The platform holds no funds. Trading happens on your Hyperliquid account through an agent wallet you approve; pay and swap return something you sign from your own wallet. We never have the ability to move your money elsewhere.
Trading-only rights
The agent wallet is approved with place/cancel order permissions. It cannot withdraw. Revoke it on Hyperliquid at any time; the local key material can be deleted from the cockpit.
The cap is server-side
Caps live in the key record and are checked before an order reaches the venue. A prompt injection, a bug or a loop cannot raise them; only the key owner can edit the policy in Settings.
Keys
- —Secrets are stored hashed; the plaintext is shown once at creation.
- —Every call is logged to the key's usage log.
- —Delete a key to revoke it immediately.
- —Keys carry a policy; create one key per product or customer.
Limits and honest failure
- —An order that reaches the venue without a confirmed response is reported as 409, recorded, and reconciled by client-order-id. It is never retried automatically.
- —The daily cap is metered from executed orders; a database write failure can undercount, so the per-call cap remains the hard stop.
- —Paper ledgers are isolated per wallet and can never overwrite a live ledger.
What we do not do
- —We do not hold, pool or lend customer funds.
- —We do not provide investment advice or guarantee returns.
- —We do not run KYC on end users of your product; that stays with you where required.
Note · Automated trading can lose the entire trading wallet. Read the Risk Disclosure before funding a live account.