Your keys, your funds, your decisions.
Control Trading Lab is built so that we never need to hold your exchange keys or your money. Here is how it works, in plain words.
What stays on your device, what reaches our servers
Stays on your device
- Exchange API keys and wallet keys, stored encrypted and protected by a passphrase only you know
- Orders: the client sends them straight to your exchange
- Your funds, which never leave your exchange account or wallet
Reaches our servers
- Your account and the strategies you build and backtest in the Web Lab
- Commands you send to your client (start, pause, stop), only if you allowed remote control
- Balances and bot status, only if you turned telemetry on
How the platform protects you
Signed strategies
Strategies sent to the client are encrypted and signed. The client refuses anything that does not carry a valid signature, and loads strategies in memory without writing them to disk.
Remote control off by default
The Web Lab can only start or stop bots once you enable remote control on the client itself. A kill switch to stop the client always works.
Account protection
Optional two-factor authentication with any authenticator app, one-time recovery codes, and protection against password guessing.
Your data, your choice
Export your data or delete your account from Settings at any time. Analytics run only if you accept them.
Report a problem
Found a security issue? Our contact for security reports is listed in security.txt.
Keep your exchange account safe
Trading only
Give API keys trading permission only. Never enable withdrawals for a bot.
Restrict by IP
If your exchange allows it, limit the key to the IP address of the machine running the client.
Strong passphrase
Use a long, unique passphrase for the client keystore and store it in a password manager.
Start small
Run a new strategy with a small amount first and compare live results with the backtest.
Test your first strategy in a minute
No account and no card: 3 backtests a day as a guest, 15 a day with a free account.