# Security

> How accounts, keys and funds are protected, and what you should do on your side.

Source: https://docs.botradix.com/security/

## Official addresses

BotRadix operates only on these domains. Bookmark them and check the address bar before signing in or connecting a wallet.

| | |
|---|---|
| Platform | `botradix.com` |
| DEX terminal and API | `app.botradix.com` |
| Documentation | `docs.botradix.com` |
| Support email | `support@botradix.com` |

BotRadix staff will never ask for your password, two-factor codes, seed phrase or main wallet private key.

## Your BotRadix account

- **Account creation** is confirmed with a 6-digit email code (valid 10 minutes). Passwords must have at least 10 characters and are stored only as one-way hashes. New registrations are temporarily closed.
- **Two-factor authentication (2FA)** with an authenticator app (TOTP). Enabling it requires your password; replacing or disabling it requires your password and a current code.
- **Account login sessions** last 8 hours (if the short-session profile is enabled, access expires earlier and renews under its configuration); they are distinct from trading authorizations. Signing out ends your sessions on every device; changing your password or 2FA also ends your other sessions.
- **Changing your password** requires an email code and a 2FA code, so 2FA must be enabled first.
- Repeated failed sign-in attempts are rate-limited.

> [!TIP]
> Enable 2FA as soon as you create your account. Without it you cannot change your password.

There is currently no self-service password reset. If you lose access, contact support from your account's email address.

## Your exchange credentials

- API keys and agent-wallet keys are **encrypted at rest** and decrypted only in memory when a bot uses them.
- They are displayed masked and cannot be changed while bots or positions depend on them.
- Grant trading permissions only, never withdrawals. See [Connecting exchanges](https://docs.botradix.com/exchanges/).

## Your DEX funds

- Under the current code, your trading key and trading sessions **cannot withdraw**; withdrawals are authorized by your wallet (a transaction or a free signature) and return funds to your own wallet. The contracts are open and unsealed: the administrator can change this logic at any time without mandatory advance notice (0 hours); absolute custody protection is not guaranteed.
- The interface validates and simulates prepared actions. State can change before execution; a successful simulation is not an execution guarantee.
- You can close your positions and withdraw directly from BaseScan, without this website. The withdrawal pause in the code in force expires after 72 hours, but that does not guarantee recovering everything within that time: exit also depends on prices, positions, orders, debts and liquidity. See [Exit without BotRadix](https://docs.botradix.com/exit/).
- The BotRadix administrator can change the logic at any time, without advance notice: **current notice 0 h, sealed no**, in a consolidation phase with sealing planned by component. The administrator can pause the DEX or withdrawals (under the current code, a withdrawal pause lasts at most 72 hours). Read [Security and contracts](https://docs.botradix.com/security-contracts/) and its [official addresses](https://docs.botradix.com/security-contracts/#official-addresses): fixed custody addresses keep the money in place during an upgrade, but new logic can change its protections.

## Platform protection

- All sites are served over HTTPS with HSTS, strict security headers and per-IP rate limits.
- Critical services are monitored continuously and restart automatically after a failure.
- Data is backed up regularly.
- The Android app adds biometric lock, screen-capture blocking and Keystore encryption.

## Good practice

1. Use a unique, strong password and enable 2FA.
2. Use a dedicated wallet for trading, with only the funds you intend to trade.
3. Create dedicated API keys and agent wallets for BotRadix, with minimum permissions.
4. Revoke trading keys, sessions and API keys you no longer use.
5. Never share screenshots that show keys, seeds or QR codes.

## Reporting a vulnerability

If you find a security issue, report it privately to **support@botradix.com** with the subject "Security", including the steps to reproduce it. Please do not disclose it publicly until it has been fixed.

## Deleting your account

You can delete your account from **Settings** once no bot, open signal, pending cycle or grid inventory remains. Deletion removes your BotRadix data (bots, history, exchange connections, alert destinations and wallet links). It does not close positions on your venues and does not affect funds held on the DEX contracts, whose withdrawal remains subject to contract rules, account state and pauses.