Security
Security and custody
Who holds which key, what Tradent can and cannot do with your funds, why the agent key can only trade, what the fee payer is, and why there is no seed phrase but you can still export your key.
This page states the technical facts about custody as plainly as we can. It is not legal advice, and it describes how the system is built, not a guarantee that nothing can go wrong. For what has and has not been independently reviewed, read Threat model and audits.
Who holds what#
| Secret or authority | Held by | Where it lives | What it can do |
|---|---|---|---|
| Your wallet key | You (via the wallet provider, Privy) | Split into shares and only reassembled inside the provider's secure environment when you sign or export. Never on Tradent servers. | Everything on your wallet and your trading account: deposit, withdraw, delegate or revoke the agent, export |
| An agent's key (one per live agent) | Tradent | Encrypted in our database. Decrypted only for the instant of one signature, and only inside a separate signing service. | Place and cancel orders on that one user's trading account. Cannot withdraw, deposit or change who controls the account. |
| The master encryption key | Tradent | Only the signing service's environment | Nothing alone. Together with a copy of the database it could decrypt agent keys (which are still trade-only). |
| The fee payer (sponsor wallet) | Tradent | Only the signing service | Pays network fees and account rent with its own SOL. No authority over any user's account. |
| Service tokens | Tradent | Environment of our own services | Let our website and trading workers talk to the signing service. Each can do only its own narrow job. |
| Phoenix's onboarding key | Phoenix | Phoenix | Co-signs the creation of a trading account |
The important property: your wallet key is the only thing that can move your money, and Tradent does not have it.
What Tradent can and cannot do with your funds#
| Tradent can | Tradent cannot |
|---|---|
| Place and cancel orders on your trading account while an agent is live (that is the agent's job) | Withdraw or transfer your money |
| Therefore cause trading gains or losses through an agent's decisions | Change who owns or controls your trading account |
| Pause all real-money agents (kill switch) | Sign a transaction as you, or see your wallet key |
| Refuse to sign an agent's order that breaks our rules | Take back a transfer you made |
| Pay fees and account setup for you | Remove an agent's on-chain permission without you. Stop agent needs your approval. |
The agent key is trade-only, enforced twice#
- On-chain, by Phoenix. The agent's key is registered as the account's *position authority*. Phoenix's program lets that role place and cancel orders only. A withdrawal, deposit or authority change signed by it is rejected by the program itself, even if we wanted it. We checked this against the deployed program.
- In our signing service. Before signing anything with an agent key, our service checks that the transaction is for that user's own account, is a single order or cancel in the expected market, uses no unexpected programs or signers, stays within fee and size limits (including the pilot's per-order cap), and is not a fund movement or an authority change. Anything else is refused before the key is touched, and every request, signed or refused, is logged.
Our trading workers (the part that runs the AI models, which read untrusted text from the internet) do not hold any key at all. They can only ask the signing service for a policy-checked order signature. The website holds no key either and only forwards your own approvals.
The fee payer#
Solana charges fees in SOL, and new accounts need rent. So you never have to own SOL, a Tradent-owned fee payer wallet pays them. It appears on your transactions as the fee payer and nothing else: it holds no tokens of yours, owns none of your accounts and has no permission on them. If it were stolen, the thief could spend the SOL in it and nothing more. It is kept at a modest balance, topped up often, and has daily spending caps.
No seed phrase, but you can export the key#
When you sign in with email or a social account, the wallet provider creates a wallet for you. You are never shown a 12 or 24-word seed phrase, which removes the most common way people lose crypto (losing or leaking the phrase). The trade-off is that you rely on the provider's secure environment and your login. To avoid being locked in, you can export the wallet key and import it into Phantom or Solflare whenever you like.
Kill switch, limits and the pilot caps#
- Kill switch. Tradent can pause all real-money agents at once. New risk stops; exits, withdrawals and stopping agents keep working. See Stopping an agent.
- Pilot caps. During the pilot the total size an agent can hold, the platform total and each single order are capped at small amounts.
- Rate limits and daily budgets on everything that the sponsor wallet pays for.
- Your own risk limits apply on top of all of the above. See Risk limits.
Your part#
- Check the address before you send money out. Transfers cannot be reversed.
- Never share your exported key or login codes. Tradent never asks for them.
- Use only the official site address, and be wary of messages offering to "restore" or "verify" your wallet.
- Start small. Real-money trading is a pilot.