How we protect your data and maintain secure platform operations
Your funds remain in your exchange account at all times. Kronos never holds or has access to your capital.
API permissions never include withdrawal capabilities. We only request trading permissions.
You can revoke API access at any time directly from your exchange account settings.
All API credentials are encrypted using AES-256-GCM before storage. Encryption keys are managed securely and rotated regularly. Credentials are never stored in plain text.
All data transmission uses TLS 1.3 encryption. Communication between your browser, our servers, and exchange APIs is encrypted end-to-end.
Row Level Security (RLS) policies ensure users can only access their own data. Database-level isolation prevents cross-user data access.
All security-relevant operations are logged for auditability. This includes API access, authentication events, and configuration changes.
Edge functions process requests in isolated environments. There are no persistent servers that could be compromised. Each function execution is independent and stateless.
API endpoints implement rate limiting to prevent abuse and protect against brute force attacks. Suspicious activity is automatically blocked.
OAuth 2.0 based authentication with secure session management. Sessions expire automatically and refresh tokens are rotated regularly.
Continuous monitoring of system health and security events. Alerts are triggered for anomalous behavior or potential security issues.