Your funds stay on your exchange.
TIYlab places orders through limited API permissions. Security relies on several complementary controls and on the correct configuration of your account.
Assets remain on your exchange
Your assets are never transferred to TIYlab and remain in your exchange account.
Withdrawals disabled
API keys must have no withdrawal access. Permissions are checked during onboarding.
Progressive, isolated simulated trial
The trial starts without an API. Optional verification accepts only a dedicated read-only key; the simulation engine cannot place orders and keeps its state separate from live mode.
Encrypted secrets
Stored API credentials are encrypted with AES-256-GCM and are never displayed in plain text.
IP restriction
IP whitelisting is required or strongly recommended depending on the exchange.
Continuous controls
Runtime guards, position reconciliation and alerts monitor operational inconsistencies.
Client isolation
Each API key belongs to one client and every bot state is stored separately.
DEX security model
- Free simulation: no wallet, signature, Agent or real order.
- Optional verification: public address only, public-data reads and still no trading.
- Live after payment: one-time authorization of a dedicated, restricted trading Agent.
On Hyperliquid, the master key is never shared and the Agent exposes no withdrawal or external transfer. On Aster, the Agent requires canSpotTrade=true, canPerpTrade=true, canWithdraw=false, TIYlab IP whitelisting and expiry. You can revoke the Agent from the protocol.
DEX balances are funded and withdrawn only by you. Any Aster transfer is limited to internal collateral within the same account. No status constitutes an absolute security guarantee.
Your security checklist
Enable two-factor authentication on Telegram and your exchange, use a dedicated API key, review every permission and do not trade manually on the account operated by TIYlab.
When an incident occurs
When an operational inconsistency is detected, runtime safeguards may suspend execution and raise an alert. You retain an independent emergency action: revoke the API key directly from your exchange, then contact TIYlab through /support.
Security limitations
Disabling withdrawals prevents assets from being transferred to an external address, but it does not remove every risk. A compromised trading key could allow harmful orders, fees or losses. No connected system guarantees absolute security against market, exchange, availability or cybersecurity risks.