Security
Your exchange API keys are the most sensitive thing Spreadr holds. Three questions matter; here are the answers.
Can Spreadr move my funds?
No — on most venues, structurally no. Wherever the venue supports it, the key you give Spreadr is trade-only:
- Hyperliquid — agent wallet key; only your parent wallet can withdraw
- Extended — Stark sub-key; withdrawal rights stay with your main key
- Orderly — trading-scoped ed25519 key
- Aster — agent wallet approved for trading only (
CanWithdrawis never granted)
These keys can place and cancel orders but cannot touch withdrawals, no matter what happens to them. Where a venue's API model doesn't offer a trade-only key (see Lighter), we recommend a dedicated sub-account holding only the collateral you trade with — each venue's page in Exchanges covers the safest setup.
Can anyone see my keys?
No — including Spreadr operators. Keys are encrypted the moment they reach us, and decryption is cryptographically bound to your user identity — not just protected by access policy. Stored credentials are useless blobs without that binding. Keys are only ever decrypted in memory while one of your trades is running, plaintext buffers are zeroed immediately after use, key material is never passed to the application logger, and error reports sent to our monitoring provider are scrubbed of credential-shaped fields before they leave the process.
What if Spreadr is breached?
The design assumes any single component can be compromised and limits what that's worth to an attacker:
- Stolen database — encrypted blobs, not keys. Useless without the per-user cryptographic binding.
- Compromised trade runtime — each trade runs isolated from every other; an attacker reaches at most the one trade-scoped key in use, not other users' or even your other trades' credentials.
- Worst case — unwanted trades against your collateral on that venue. Not theft: withdrawal rights never leave your own wallet.
Security-relevant account actions — credential additions and deletions, kill-switch activity, access changes — are captured in an audit log, and every trade keeps a durable execution log of its fills and hedges. You can request copies via support at any time.
Good hygiene on your side
- Use trade-only keys / dedicated sub-accounts as described on each venue's page — never a key with withdrawal rights.
- Rotate keys quarterly: delete the exchange connection in Settings → Wallets and reconnect — a fresh key is generated and registered each time.
- Set an IP allowlist on Spreadr API keys you create for bots.
Reporting a security issue
If you find something, contact us via support before public disclosure. We don't have a bug bounty program yet but treat reports seriously and acknowledge contributions on request.