Security & Encryption
How WealthyBot protects your exchange credentials and data.
API Key Encryption
All exchange API keys and secrets are encrypted using AES-256-GCM encryption before being stored. This means:
- Keys are encrypted at the application level before reaching the database
- A master encryption key is stored separately as an environment secret
- Key derivation uses PBKDF2 with 100,000 iterations and unique salt per value
- Encrypted values are prefixed with version and metadata for future key rotation
- Keys are only decrypted in memory at the moment of exchange API calls
How Custody Differs by Connection
| Connection | Who controls the funds | What WealthyBot stores |
|---|---|---|
| Exchange (CEX) API key | Your exchange account | An encrypted trading key. Never enable withdrawal permission. |
| Read-only wallet | You | A public address only — it can't move funds. |
| Bot wallet | A server-managed wallet created for you | An encrypted signing key. WealthyBot can sign swaps and withdrawals from it, and you can export the key. |
| Prediction wallet | Your Polymarket or Kalshi account | Encrypted signing or API credentials needed to place orders. |
- For exchange trading, your funds stay on the exchange and you can revoke the key there at any time
- Only put money you intend to trade in a bot wallet — it is a hot wallet, not cold storage
- Never share private keys or secrets in chat or support messages
Data Protection
- All communication is encrypted via HTTPS/TLS
- User authentication is handled by the platform with secure session management
- Admin-only functions require role verification
- Multi-user support ensures data isolation between accounts
Illustrative example · API Key Encryption Flow
🔑
Your API Key
Vx7Kp9...mQ3z
↓
🔐
AES-256-GCM
PBKDF2 · 100K iterations
↓
🗄️
Stored Encrypted
v1:a3F...encrypted
Note
If you suspect a key has been compromised, delete it on your exchange, create a new one, and update it in Settings → Accounts.
WealthyBot Documentation · last reviewed September 2026© 2026 WealthyBot