Security & compliance

The key you use to look at your account and trade by hand is stored in an encrypted vault in your own browser: AES-256-GCM, wrapped by a device key that is generated non-extractable, so no script — including ours — can read it out. It is decrypted in memory for one request at a time and sent to our server only for the duration of that request. It is never written to our disks. The screen shows provider and the last four characters, never the key.

The always-on guardians (algo guard, profit floor, liquidation guardian) run on our server whether or not your phone is on. To do that they need a Trade-permission key on the server. You opt in; the key is encrypted at rest with AES-256-GCM under a server secret that lives only in the server's environment, never in code, and is decrypted only when a guardian acts. Remove the key and the guardians stop the same minute.

Create the key with view and trade permission only. Wingman never moves funds out of your exchange, and a key that could is a key with more permission than it needs; we will tell you if we see one.

A guardian places or cancels orders on positions the account holds, under the sensitivity, floor and liquidation settings you saved. It does not open positions on its own.

The liquidation guardian has a hard cap on protective actions per 24 hours; if it hits the cap it disables itself and writes the reason where you will see it, rather than keep acting.

Any product you mark as a legacy hold is invisible to every guardian: no guard, no floor, no liquidation sale. You can still trade it by hand. The hold is about the algorithm, not about you.

Every order Wingman places or cancels is written to a ledger you can read, with the exchange's own order id, price and time, so anything can be checked against the exchange's records. The forensic audit reconciles the account to the cent and states the unexplained part rather than hiding it.

Subscriptions are billed through Stripe. Card details go to Stripe's checkout and portal; we store a customer id and a subscription status, nothing more.

Email and password hash, session, the exchange records needed for the cockpit and the audit, guardian logs, and a Stripe id. No withdrawal credentials, no bank or card numbers, no exchange passwords. See the privacy policy for retention.

All traffic is HTTPS, fronted by Cloudflare. The trading server is not exposed directly to the internet.

Your account records and your questions to Deb are not used to train any model, ours or anyone else's.

Production build of the trading server on dedicated infrastructure, secrets in a managed store, automated backups of the ledger and audit data, and monitoring with alerting. This is the prerequisite for everything that follows.

A third-party test of the web application, the API routes and the key-handling paths, with the report available to partners under NDA.

Scoped to the trading server, the guardians, the audit pipeline and key handling. Type I attests the controls exist at a point in time; Type II attests they operated over a period. We will publish the scope when the audit window opens.

An exchange partnership will carry its own review — data-handling addenda, incident-response commitments, sub-processor lists. We will meet them as part of the pilot agreement.