> For the complete documentation index, see [llms.txt](https://docs.thevolumeterminal.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.thevolumeterminal.com/exchange-connections/security-best-practices.md). # Security Best Practices Volume Terminal is built with a security-first architecture. Because we are non-custodial and never touch your assets directly, your primary security focus lies in managing your exchange API keys. By following these best practices, you can ensure that your trading account and funds remain completely secure. *** ### Core Security Rules > \[!IMPORTANT] **1. Disable Withdrawals** During the creation of your API key on your exchange, the **Withdraw** and **Transfer** checkboxes must remain unchecked. Volume Terminal's backend automatically inspects all linked keys. If it detects withdrawal permissions, it will reject the key and block the connection. > \[!IMPORTANT] **2. Limit API Permissions** Only enable **Read-Only** permissions (to sync trade history and track volume). Do not check any trade, write, or execution permissions. This ensures the key has zero execution power and is completely safe. *** ### Recommended Security Measures #### 1. Use Exchange Sub-Accounts Most major exchanges (Bybit, Binance, OKX, Bitget) allow you to create **Sub-Accounts** under your main account. We highly recommend using sub-accounts for Volume Terminal campaigns: * **Isolation**: Keep your long-term holding portfolios or primary trading capital in your Main Account. * **Capital Control**: Only transfer the capital you intend to use for the specific campaign into the Sub-Account. * **Key Containment**: Generate your API keys specifically for the Sub-Account. If a key is ever compromised, exposure is strictly limited to that sub-account's balance. #### 2. Bind API Keys to Static IPs (IP Whitelisting) For maximum security, restrict your API key to only accept requests coming from trusted IP addresses. * During the connection setup on Volume Terminal, you will be provided with our static IP whitelist addresses. * Copy these IPs and paste them into your exchange's API configuration under "IP Restrictions". * This ensures that even if your API key and secret are somehow exposed or leaked, they cannot be used by anyone else, as the exchange will block any requests originating from non-whitelisted IPs. #### 3. Rotate Your API Keys Regularly It is good security hygiene to delete your existing API keys and generate new ones periodically (e.g., every 90 days). * This limits the lifetime of any credentials. * To rotate: create a new key on your CEX, connect it to Volume Terminal, and then delete the old key on the CEX. *** ### How Volume Terminal Protects Your Keys We treat your API credentials with bank-grade security protocols: * **Encryption at Rest**: Your API keys and secrets are encrypted using AES-256 encryption before being stored in our secure database. The encryption keys are managed separately. * **Encryption in Transit**: All communication between your browser, our servers, and the exchange endpoints is encrypted via secure SSL/TLS protocols. * **Restricted Access**: Our internal systems access your keys solely to query trade logs and calculate volume. No human administrator has access to raw API secrets. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.thevolumeterminal.com/exchange-connections/security-best-practices.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.