Security at AutoQube
This page explains, in plain language, how AutoQube is built: where your data lives, how your exchange API key is handled, and — most importantly — what the software technically cannot do, no matter what. It is informational; the binding documents are the Terms of Service, Privacy Policy, and Risk Disclosure.
The design in one paragraph
AutoQube is non-custodial by design. Your funds never leave your own exchange account. The Service connects to your exchange through an API key that you create, with trading permission only. We have no wallets, take no deposits, and hold no assets. If you revoke the key at your exchange, all access ends immediately — that switch is always in your hands.
What we technically cannot do
- We cannot withdraw or transfer your funds. API keys are required to be trade-only. When you connect a key, the Service checks its permissions; keys with withdrawal or transfer capability are rejected and not retained. This check fails closed — if the permission check cannot be completed, the key is not accepted.
- We cannot access your exchange account itself. We never ask for — and have no place to enter — your exchange username, password, or two-factor codes. The only credential the Service ever holds is the trade-only API key.
- We cannot hold your money. There is no AutoQube wallet and no deposit address. There is nothing to hack that contains your funds, because your funds are never here.
- We cannot keep access you have revoked. Deleting the API key at your exchange instantly disables every capability the Service had. You do not need our cooperation to shut us out.
How your API key is stored
- Keys are transmitted over TLS and stored only in the execution engine, encrypted at rest with symmetric encryption (Fernet).
- Keys are never stored and never logged in our API layer or anywhere else outside the engine.
- Keys are deleted when you disconnect your exchange, when your subscription ends and automation is deactivated, or when you delete your account — whichever comes first.
What we store — and what we don't
Stored: your account email, plan, in-app acceptance records, and the execution ledger of trades opened by your templates (symbol, size, entry/exit price, realized PnL, protective-order references, timestamps). The ledger is what powers your Portfolio and Activity views and our reconciliation checks.
Not stored: your exchange balances and positions are read transiently, at the moment of use only — to size a trade, show live PnL, or warn about minimum trade sizes — and are never stored and never logged. We hold no exchange passwords and no payment card data. This website sets no cookies and runs no trackers.
Operator access: the operator does not view or browse user accounts. Momentary access to account data occurs only within the software's own operation — executing template orders, reconciliation checks, and the views the app renders for you.
Signing in
AutoQube is passwordless. You sign in with a one-time code sent to your email; codes and session tokens are stored hashed, and sign-in attempts are rate-limited. There is no AutoQube password to steal or reuse.
Infrastructure practices
- TLS for all transport, everywhere.
- Internal service-to-service communication is HMAC-signed.
- Daily automated database backups.
- Access is limited to what operating the Service requires.
Controls you hold
- Stop control ("kill switch") in the app: stops the opening of new positions at any time; open template trades are closed only with your explicit confirmation.
- Disconnect your exchange in the app — your API key is deleted from our systems.
- Revoke at the exchange — works even without us, instantly.
- Data export and account deletion, both in the app (Profile).
Reporting a vulnerability
If you believe you have found a security issue, email support@autoqube.app with the subject "Security report". We read every report and will respond.
No method of storage or transmission is 100% secure, and we do not claim absolute security. This page describes how the Service is built today and is updated as the architecture evolves. AutoQube is a software tool — not a broker, custodian, fund, or investment adviser; nothing on this page is investment advice.