Security — non-custodial

One-line principle

Both decision and execution (keys, signing, submission) happen on your device. stocksori servers are not in the trade path.

• API keys are never stored on stocksori servers. Orders are signed and sent by your agent directly to the exchange.
• The server cannot create or forge orders.

E2E encrypted remote control

Controlling your VPS agent from the browser uses end-to-end encryption (ECDH P-256 + AES-256-GCM). The server relays ciphertext it cannot read; displayed fingerprints let you detect MITM.

Key safeguards

• Keys with withdrawal permission are rejected — the agent verifies permissions on registration.
• Keys are stored encrypted on the agent host too (no plaintext files).
• The live-order switch can only be flipped through the E2E channel — never by the server.

Guardrails

Live orders require explicit consent to order caps and a loss kill-switch at deploy time. The kill-switch uses a fee-inclusive P&L ledger.

Security of your own server (VPS) is your responsibility. Always use keys without withdrawal permission.