Security

Arbitron is built so that the worst-case scenario stays small. We never hold your funds, we never ask for withdrawal permissions, and your API keys live encrypted on infrastructure dedicated to you alone. This page explains exactly how that works.

Non-custodial by design

Your funds never leave your own exchange accounts. Arbitron connects through exchange API keys and places trades on your behalf — withdrawing or transferring your money is technically impossible for us.

API keys are used with trade-only permissions: reading account data, placing and cancelling orders. We never ask you to enable withdrawal rights, and our setup guides explicitly tell you not to.

Your own server with a unique IP

Every Arbitron user gets a dedicated, isolated trading server with its own static IP address. Your trades are not executed from shared infrastructure, and no other user's workload runs on your machine.

Because the IP belongs to you alone, you can whitelist it when creating your exchange API keys. The exchange will then reject that key from any other address — even a leaked key is useless outside your own server.

Each server also has its own identity. It can unlock only your API keys and read only your account's data, so if one server were ever compromised, the damage would stay with that one account.

How your API keys are stored

Keys are encrypted with AES-256-GCM before they are written to the database.
Each user has their own data-encryption key, protected by AWS Key Management Service. A trading server can unlock only its own user's key, and there is no master password that opens everyone's keys at once.
Keys are decrypted only at the moment of use and never appear in logs, analytics, or backups in plain text.
Keys reach your server still encrypted and never cross our internal network in plain text.

Account protection

Two-factor authentication with an authenticator app, plus passkeys for signing in without a password.
An account needs two-factor authentication to start trading, add risk to a running strategy, or add or change exchange keys. Stopping a strategy, cutting risk or closing a position never requires it.
Every sign-in and password reset goes through a bot check, and repeated failed attempts lock sign-in for a while.
Sessions expire after a set time, even on a device that never signs out.
Mandatory email verification on every account.

Alerts and control

An email when someone signs in to your account from a network it hasn't used recently.
An email when someone resets your password, turns two-factor on or off, adds a passkey, links a Telegram account, or changes your email address (we write to the old one).
An email when sign-in is locked after repeated wrong passwords or codes.
Real-time Telegram notifications for trades, status changes, and infrastructure events — you see what your account does as it happens.
A kill switch that instantly stops all trading on your account with a single action.

Infrastructure

Hosted on AWS; traffic between our services runs over a private network, never the public internet.
TLS encryption for everything between your browser, our servers, and the exchanges.
Every order, fill, and trade event is recorded in an append-only event log — a complete, auditable history of what the system did.
24/7 automated monitoring with heartbeats from every trading server — failures alert our team immediately.
Every service has only the access its job needs, and automated threat detection watches our whole cloud account.
Staff accounts require two-factor authentication. Suspicious sign-in activity and any change to staff access alert the team in real time.
Backups are monitored and protected from deletion.

What Arbitron can never do

Withdraw or transfer funds from your exchange accounts.
Hold your trading capital — it stays on your own exchange accounts at all times.
Trade outside what you set up. Every position traces back to a strategy or an automation you configured yourself.
Start trading without you. A strategy trades only once you start it, or through an automation you switched on yourself, such as Auto Start or copy trading.

What we ask from you

Create a dedicated API key for Arbitron on each exchange — never reuse keys across services.
Never enable withdrawal permissions on those keys.
IP-whitelist each key to your Arbitron server address, shown in your settings.
Turn on two-factor authentication on Arbitron and on your exchange accounts, and add a passkey on Arbitron too.
If a security email from us describes something you didn't do, change your password and contact support right away.

Reporting a vulnerability

Found a security issue? Email support@arbitron.app — security reports are read first and acted on immediately. We are grateful for responsible disclosure.

An honest note on risk

Infrastructure security protects your keys and funds from unauthorized access — it does not remove market risk. Arbitrage trading involves a real risk of loss, and past performance never guarantees future results.