Security: how AI Trading Fleet protects your account

Updated 25 September 2026 · By Amit Kumar

Does the Fleet hold my funds?

No. Your money stays in your own exchange, broker or prediction-market account. The Fleet is not a custodian, not a broker and not an exchange. It sends orders to your account through the venue’s official API, the same way you would by hand.

Can the Fleet withdraw my money?

Binance and Bybit: no. When you connect a key, the Fleet asks the exchange what the key is allowed to do. If the key can withdraw, it is refused and not stored. A trade-only key can place and cancel orders, but it cannot send funds out of the account.

Polymarket: Polymarket has no trade-only permission. Orders are signed by a wallet key, and that key controls the wallet. Use a dedicated wallet that holds only what you plan to trade, never your main wallet.

Kalshi: withdrawals go to the bank account linked to your Kalshi account, through Kalshi itself. The Fleet only uses the trading API. Keep only your trading capital in the account.

Which API permissions does it need?

• Read: balances, positions and order history, so it knows what you hold.
• Trade: place and cancel orders.
• Withdraw: never. Turn it off when you create the key.

Create a new key just for the Fleet and, if the exchange allows it, restrict it to the Fleet’s IP addresses. The API key safety guide has the full checklist.

How are my keys stored?

Your API credentials are encrypted before they are written to the database, using Fernet (AES-128 in CBC mode with an HMAC-SHA256 integrity check). The encryption key is an operator secret kept outside the database. If stored ciphertext is changed or the key doesn’t match, decryption fails and the credential is treated as unusable rather than guessed at.

How do I revoke access?

Delete the API key on the exchange. That cuts the Fleet off at once, whatever state the Fleet is in. You can also press the kill switch first, which stops every new order across all strategies.

What limits protect the account?

Every order passes propose(), a pure risk function with no network access, no clock and no randomness. It checks the order against the limits you set: daily loss, drawdown from peak, per-position size, per-venue and total exposure. If any check fails, the order is cut or refused. Strategies can’t change these limits.

What happens if the Fleet goes offline?

No new orders are sent. Positions and orders already on the exchange stay there, because they live on your account, not on the Fleet. Exits the Fleet manages itself, such as a trailing stop on a prediction-market position, won’t fire while it is offline. That’s one reason positions are sized to a fraction of what your limits allow. You can always close positions directly on the exchange.

What happens if an exchange API fails?

Every order carries an idempotency key derived from the decision that made it. If a request times out and is retried, the retry reuses the same key and is recognised as the same order, so a timeout can’t turn into a second order. If the same key ever arrives with different order details, the order is refused and an alert goes out.

Is every action recorded?

Yes. Every risk decision, order, rejection and kill-switch press is written to a hash-chained, append-only audit log. Changing any past row breaks the chain. Try it on the audit-chain demo.

What data do you keep about me?

Your email or Telegram ID, your reservation and payment records, and, after launch, your encrypted API keys and your limits. We don’t see your exchange password and don’t need your ID documents. The privacy policy has the details.

Reporting a security issue

Email [email protected] with the details. Please give us a reasonable time to fix it before making it public.

Questions

Trading involves risk of loss. Nothing here is investment advice. Read the risk disclosure.