Encrypted before storage
API credentials are encrypted with AES-256-GCM before they reach the database. The encryption is authenticated, so tampered data fails loudly rather than decrypting into something that could be sent to an exchange.
Security
Triggon never holds your funds. It cannot move them.
Auto-Trade works through API keys you create on your own exchange. That arrangement is only as good as what those keys are allowed to do. So Triggon takes that decision out of your hands.
Connecting a keyvalidated at connection
Readbalance, positions, prices✓
Tradeplace, modify, close✓
Withdraw · transfera key with this is refused✗
IP restrictiondetected✓
✓Connected · encrypted before storage
What the server holdsAES-256-GCM
API secret
enc:v1:9f3a7c…d41e · authenticatedMaster key
server environment only · not in the databasePlaintext
one module, one exchange call, never loggedSigning inno password
✓Telegram signs the request · the server verifies every call
What Triggon can and cannot do
What it can do
Place, modify and close orders on the exchange account you connect, for the Strategies you have chosen, inside the limits you have set.
Read your balance and open positions, in order to size those orders correctly.
Read market data from the exchange to check a price is fresh before acting on it.
What it cannot do
Withdraw or transfer your funds. An API key with withdrawal or transfer permission is refused at connection. It is a hard validation failure, not a warning you can click past. The key is not stored and the connection is not made.
Take custody of your assets. Your funds never leave your exchange account, and there is no arrangement under which they could pass through Triggon.
Trade an account you have not connected, or run a Strategy you have not enabled.
Advice is not a control. A key carrying withdrawal or transfer permission is
refused at connection and never stored, so the protection does not depend on anyone
reading an instruction carefully on the day they are in a hurry.
How your credentials are stored
Keys live outside the database
The master encryption keys exist only in the server's environment, never in the database, never in the codebase, never in a settings table. Someone holding a copy of the database holds nothing usable.
One component can decrypt
Exactly one module ever sees a credential in plaintext, and only for the duration of a single exchange call. No API response, log line or audit record is permitted to carry a decrypted value.
It fails closed
If the encryption key is missing from the environment, Triggon refuses to store a credential at all. There is deliberately no fallback that would let a misconfigured deployment quietly save one unprotected.
Signing in, and the rest of your account
No Triggon password
You sign in with your Telegram account. Telegram signs each request cryptographically and the server verifies that signature on every call. There is no Triggon password to be guessed, reused or leaked in someone else's breach.
Why the terminal only opens in Telegram
Opened from a plain browser there is no signature to verify, so there is nothing to show. That is the same property that removes the password, seen from the other side.
Provider documents
Files submitted with a Provider application are served only to reviewers, by identifier, as attachments. They are not addressable by name and are not public.
Signals are validated before they execute
A Signal with a stop on the wrong side of the price is rejected at ingest, before it can reach any account. A repeated Signal is recognised and never applied twice.
Each Strategy's connection is its own
A Provider's Strategy has its own private connection and its own secret, rotatable at any time. One Strategy's credentials give no access to another's.
Platform-level limits
Order size ceilings, slippage limits and freshness checks apply above every user and Provider setting, as a backstop that individual configuration cannot widen.
What we ask you to do
- Never enable withdrawal permission on a key you connect anywhere. Triggon will refuse it, but the habit protects you at services that will not.
- Use a key created for this purpose. A dedicated key can be revoked without disturbing anything else you run.
- Restrict the key by IP where your exchange supports it. Triggon detects whether a key is IP-restricted and shows you.
- Set limits you would be comfortable losing. Every rail described on this page constrains execution, not market risk. Read the risk disclosure →
Found something that looks wrong? Write to
support@triggon.app and tell us what you found. We
would rather hear it from you.