Vectixs places orders on your own exchange account using an API key you create and can revoke. It never holds your funds, never asks for withdrawal permission, and never shows your key back to your browser once you have saved it.
These are not promises we could quietly change. They follow from how the product is built.
No deposit wallets and no deposit addresses exist. Your coins stay in your own exchange account for their entire life, and an order placed by a bot is an order on your account, executed and settled by your exchange. We are never a counterparty and never a custodian.
Vectixs calls only the trading and balance-reading parts of an exchange's API. There is no code anywhere in it that can move funds off an exchange, so a withdrawal cannot be requested even by mistake. Create your key with withdrawals disabled and nothing will ever ask for more.
Keys and secrets are encrypted before they are written to the database, using authenticated encryption, so tampering with a stored value is detected rather than decrypted. No route on this site can read one back to your browser, not even partially masked.
The datastores holding that encrypted material are not reachable from the public internet. The database accepts connections only from an explicit list of our own servers, and the cache is bound to a private network behind a firewall that allows a single known address.
The same three steps on Bitkub, Binance, Binance TH, Bitfinex and WOO X. Do this on the exchange's own website, never through a link someone sent you.
This is the one that matters. A key without withdrawal permission cannot move your coins anywhere, no matter who holds it or what they do with it. Every exchange here lets you disable it, and most default to it already being off.
Bots need to read your balances and open orders, and to place and cancel orders. That is the whole list. If an exchange offers other scopes, such as transfers between sub-accounts or margin borrowing, leave them off.
Most exchanges let you restrict a key to specific addresses, so a stolen key is useless from anywhere else. There are only two of ours, and they are printed below.
Bind both, not just one: requests come from either server. After saving, place one small test order. If the exchange rejects it on an IP error, remove the restriction and tell us, rather than leaving a bot unable to trade.
188.166.225.43, 143.198.205.116
The names differ, the three steps above do not. Exchanges redesign these screens from time to time, so treat this as where to look rather than an exact click path.
Stuck on any of these? Send us a message and we will walk you through it on your actual screen.
Including the gaps. A security page that only lists strengths is not worth reading.
Keys and secrets are encrypted with an authenticated scheme before they reach the database, so a copy of the database alone does not yield a usable key.
Passwords are stored as bcrypt hashes. We cannot read your password, and a password reset issues a new one rather than recovering the old.
The site is HTTPS only and tells browsers to refuse plain HTTP. Your session is a signed, HTTP-only, Secure cookie, so page scripts cannot read it and it is never sent over an unencrypted connection.
Five failed attempts on an account locks further tries on it for five minutes, which makes password guessing impractical without affecting anyone typing their own password wrong.
Administrative pages are enforced on the server for every request, not by hiding buttons in the browser. There is no client-side check to bypass.
This is the most significant gap on the list and we would rather you hear it from us. Until it exists, use a long unique password here, and keep two-factor authentication switched on at your exchange, where it protects withdrawals regardless of anything on our side.
There is a drawdown limit that halts real trading when your account falls a set percentage from its peak, but it is off until you set it, and it is not a guarantee: a fast enough move, an exchange outage, or a bug can all outrun it. Automated trading carries real risk of loss, and no setting here removes that.
An attacker with our database still does not have your coins. Keys are encrypted rather than stored in readable form, and even a usable key cannot withdraw anything if you created it with withdrawals disabled, which is why that step matters more than anything we do. The worst realistic case is unwanted trading on your account, which is why you should also be able to revoke the key yourself in seconds.
Yes, and we would rather you started that way. Mock mode gives you a practice balance priced off live market data, and every bot behaves exactly as it would with real funds. It needs no API key, no deposit and has no time limit, so you can judge the product before trusting it with anything.
From your exchange's own API settings, by deleting the key. That takes effect immediately and does not depend on us doing anything. You can also clear the key from your Vectixs profile, which removes our stored copy, but deleting it at the exchange is the one that actually ends access.
Administrative tools in this product deliberately expose mock-mode activity only, never real balances, real orders or credentials. The public leaderboard is off by default and shows nothing unless you turn it on yourself.
Custody is safe, in the sense that we cannot take your money. Trading is not: bots can lose money, markets move faster than any rule, and exchanges have outages. Treat mock mode as the place to find out how a configuration behaves, use position sizes you can afford to be wrong about, and never run a strategy you cannot explain.
Written by the person who runs this platform daily with his own money — read the background, or start on a free mock wallet with no API key at all.