Security & Connected Accounts
How read-only exchange connections work and how we protect them.
Last updated: 16 August 2026
Policy status
Traidilon is currently in beta. These policies are provided to explain how the current service operates and may be updated as Traidilon's legal entity, services and operations are finalized. Certain legal and business details may currently be pending confirmation. The policies should not be considered legal advice.
How connected accounts work
Pro users can optionally connect a supported exchange or broker (Binance, Coinbase, Kraken, Alpaca) by entering API credentials that you create in that provider's own dashboard. Traidilon uses them to read account balances so analysis can reference the assets you hold.
Read-only by design
These integrations are read-only. Traidilon never places orders, transfers funds or requests withdrawal permissions. When you create the API key at your provider, enable read permissions only and leave trading and withdrawal disabled. If a key with wider permissions is supplied, Traidilon still only performs read calls, but you should not grant permissions the product does not need.
How credentials are handled
Credentials are encrypted before they are stored, kept separately from your general account data, restricted so that only your account can reach them, and used only on the server to sign read requests to your provider. They are never returned to the browser. No system can be described as 100% secure, and we do not make that claim.
Disconnecting
Open Connected accounts and choose Disconnect. This removes the stored connection and its encrypted credentials, and the cached balances associated with it. Analyses you already generated remain in your History. For complete safety, also revoke or delete the API key in your provider's dashboard — that is the only action that guarantees the key can no longer be used by anyone.
General security measures
- Per-user access rules enforced in the database.
- Private storage for uploaded images with short-lived signed access links.
- Encrypted storage of connection credentials.
- Server-side enforcement of plan limits and access checks.
- HTTPS for traffic between your browser and the service.
Reporting a vulnerability
Report suspected security issues to our security contact (email address being finalized). Please give us reasonable time to investigate before public disclosure, and do not access other users' data while testing.