Security overview
This page describes what the software does today. It is not an audit or certification; independent review is planned as the product grows.
AlgoBee is a hosted service: it runs on servers we operate, and the exchange credentials you add are stored there, encrypted. Orders are sent from the server directly to each exchange over TLS. Larger users and institutions can run their own AlgoBee node instead, so credentials never leave their own infrastructure.
Exchange secrets (API secrets and private keys) are encrypted with AES-256-GCM, which also detects tampering. The encryption key is kept outside the database and is readable only by the service that runs AlgoBee. A copy of the database alone does not reveal the secrets.
After a secret is saved, the interface shows it masked and the API does not return it, to anyone, including our own support staff. To change it, enter a new value; leaving the masked value keeps the stored one. Support can see account settings and strategy configuration in order to help you.
Session tokens are signed with a key unique to each installation, never a shared default. Two-factor authentication can be enabled per user.
Portfolio strategies start in dry run. Venues where live order placement has not been released keep it disabled. The funding strategy raises an alert and pauses new entries when a pair stays unhedged.
If you run AlgoBee on your own servers, back up the encryption key together with the database. Without the key, stored secrets cannot be decrypted and must be entered again. Installations that share configuration need the same key.
Recommended setup
Good exchange-side settings matter as much as local storage. We recommend:
Create API keys with trading and read access only. AlgoBee never needs withdrawal or transfer permissions.
Where the exchange supports it, restrict each key to the IP address of the server that runs AlgoBee. Contact us for the address of the hosted service.
Use a sub-account per strategy or venue pairing, so each key's reach and margin are limited.
Please report it privately to security@algobee.net. Include steps to reproduce; we will acknowledge your report and keep you informed while we fix it. Please do not test against accounts that are not your own.