Security & Infrastructure

    How we protect your data and maintain secure platform operations

    Security Principles

    No Fund Custody

    Your funds remain in your exchange account at all times. Kronos never holds or has access to your capital.

    No Withdrawal Access

    API permissions never include withdrawal capabilities. We only request trading permissions.

    User Control

    You can revoke API access at any time directly from your exchange account settings.

    API Permission Model

    Permissions Requested

    • Read account information (balance, positions)
    • Enable Futures trading (if using futures)
    • Enable Spot trading (if using spot)

    Permissions Never Requested

    • Enable Withdrawals
    • Enable Internal Transfers
    • Enable Universal Transfers
    • Any permission allowing fund movement out of your account

    Technical Security Measures

    Encryption at Rest

    All API credentials are encrypted using AES-256-GCM before storage. Encryption keys are managed securely and rotated regularly. Credentials are never stored in plain text.

    Encryption in Transit

    All data transmission uses TLS 1.3 encryption. Communication between your browser, our servers, and exchange APIs is encrypted end-to-end.

    Data Isolation

    Row Level Security (RLS) policies ensure users can only access their own data. Database-level isolation prevents cross-user data access.

    Audit Logging

    All security-relevant operations are logged for auditability. This includes API access, authentication events, and configuration changes.

    Infrastructure

    Serverless Architecture

    Edge functions process requests in isolated environments. There are no persistent servers that could be compromised. Each function execution is independent and stateless.

    Rate Limiting

    API endpoints implement rate limiting to prevent abuse and protect against brute force attacks. Suspicious activity is automatically blocked.

    Authentication

    OAuth 2.0 based authentication with secure session management. Sessions expire automatically and refresh tokens are rotated regularly.

    Monitoring

    Continuous monitoring of system health and security events. Alerts are triggered for anomalous behavior or potential security issues.

    Your Security Responsibilities

    • Create API keys with minimal permissions. Only enable trading permissions — never enable withdrawals or transfers.
    • Protect your credentials. Never share your API secret or platform password with anyone.
    • Enable 2FA on your exchange. Two-factor authentication adds an extra layer of security to your exchange account.
    • Review API permissions regularly. Check your exchange API management to ensure permissions are as expected.
    • Report suspicious activity. If you notice unexpected behavior, contact support immediately.

    More Information

    Learn more about our platform and policies