1. Overview
This Security Policy describes the technical and organizational measures Aegis Bot uses to protect user data and platform integrity.
2. Password Security
Passwords are never stored in plaintext. All passwords are hashed using the scrypt key derivation function before storage. Aegis Bot does not use bcrypt or argon2 for password hashing.
3. API Key and Signing Key Protection
Exchange credentials submitted by users — including the HyperLiquid signing key and centralized-exchange (CEX) API keys — are encrypted at rest using AES-256-GCM before being stored in the database. Keys are decrypted only within the bot runtime when required for exchange operations. Plaintext keys are never logged or exposed through the dashboard API.
The HyperLiquid signing key is itself a private key used to sign trading actions autonomously on your behalf. By HyperLiquid’s API-wallet design, it cannot withdraw or transfer funds, regardless of any user configuration. CEX API keys (Binance, BingX — integration planned, not active in the current beta) instead rely on exchange-side permission toggles that you must configure to exclude withdrawal and transfer permissions; Aegis does not technically verify that configuration.
4. Data Encryption in Transit
All communication between users and the platform occurs over HTTPS (TLS). Communication between internal services uses authenticated channels.
5. Data Encryption at Rest
Exchange API keys are encrypted with AES-256-GCM. Encrypted backups of the database are planned as part of the infrastructure roadmap and will be implemented when infrastructure conditions permit; they are not guaranteed to be available at the time of initial deployment.
6. Authentication and Session Security
User sessions are managed through the Better Auth framework with configurable expiry and session caching. Email verification is required for new accounts when an email delivery service is configured. Two-factor authentication (2FA) is available as an optional account security feature, using time-based one-time passcodes (TOTP) with single-use backup codes.
7. Consent Records
Aegis Bot records auditable consent at account creation and on subsequent consent events, including the IP address and user-agent at the time of acceptance. These records are retained as a legal audit trail.
8. Vulnerability Disclosure
If you discover a security vulnerability in Aegis Bot, please report it responsibly to the contact email published in the data-controller section of the Data Treatment Policy. Do not disclose vulnerabilities publicly before we have had a reasonable opportunity to investigate and remediate.
9. Incident Response
In the event of a security incident affecting user data, we will notify affected users and relevant authorities as required by applicable law.
10. Limitations
No security measure is absolute. Exposure of data through misconfiguration or zero-day vulnerabilities remains a residual risk that we actively monitor and mitigate. For centralized exchanges, users should exercise caution with their API credentials and use API keys with minimal required permissions (trading only, no withdrawal access). For HyperLiquid, the signing key structurally cannot withdraw funds by design — but its compromise still carries operational risk, since it can open, modify, or close trades autonomously; treat it with the same care as any other trading credential.
11. Changes to This Policy
We may update this policy periodically. Material changes will be notified via the platform or by email.