SeaYour keys, your data, your decisions.
This page describes the protections that are actually in place. We do not claim certifications or regulatory approvals.
Exchange API connectivity
You connect your own exchange with an API key you create. The key is checked with your exchange before it is saved. It is used only to read your balances and orders, cancel orders, and place the orders you confirm.
API permissions
Create keys with trading enabled and withdrawals disabled. Sea Liquidity never needs withdrawal permission. Where your exchange offers IP allow-listing or sub-accounts, you can use them too.
Credential protection
Keys are encrypted with AES-GCM using a server-held master key, bound to your account and that key's ID. They are never sent back to the browser. Each request decrypts a key only to make that one call, through a private service that stores nothing.
User-controlled execution
Every order starts as a preview, valid for 2 minutes. Only your Confirm places that exact order, once. Leverage is set only at confirm; if it can't be set, nothing is sent. Nothing is ever placed automatically.
Account security
Passwords are stored only as PBKDF2-SHA256 hashes with a random salt. Sessions use a random token in a secure, HttpOnly cookie, and only its hash is stored. Email confirmation, one-time reset links and rate limits protect sign-in.
Data handling and privacy
Each customer's records (journal, trades, orders, cards, statistics) live in that customer's own private database. One customer can never read another's. Shared market views are read-only.