Because Cryptelix touches your exchange API keys, we treat security as infrastructure — not an afterthought. Here's how the system is built.

Encryption at rest

Your API keys and secret tokens are never written to disk in readable form. The moment a key arrives at our servers, it is encrypted and stored. Here's the flow:

1. Keys are encrypted immediately on ingestion using AES-256 — the same standard used by banks and governments.
2. The master encryption keys live in a dedicated secrets manager, completely isolated from the main application database. They are never co-located.
3. If an attacker obtained a full dump of our database, they would get encrypted binary strings — useless without the master key, which is stored separately.

Encryption in transit

• TLS 1.3 everywhere. All traffic between your browser, our servers, and Binance's API runs over TLS 1.3 / HTTPS. There is no fallback to older protocols.
• Signed session tokens. Authentication runs through cryptographically signed JWT tokens with short lifetimes. Sessions expire automatically if anything about the context changes.
• Private infrastructure. Databases and processing modules sit inside private cloud networks with restricted port access. Nothing is publicly reachable except what needs to be.

The structural safety net

Read-only access isn't just a policy — it's a hard technical constraint built into Binance's own engine. Even in the worst-case scenario, this matters a great deal:

You remain responsible for verifying that trading and withdrawal permissions are unchecked when you generate your key inside your Binance account. That's the one step on your side of the line.