Custody and Keys

This page answers a simple question:

Who holds your money - and what does Chatito store so strategies can run?

Short answer: your funds stay yours. Chatito is automation software, not a bank and not a place that takes deposit custody of your crypto. When live automation needs credentials, we store them encrypted, and only for the job you chose.

This is product truth in plain language. It is not legal advice and not a compliance certificate. For the formal wording, see Terms and Privacy. For how we practice security day to day, see Security.

The One-Line Story

Idea	What it means for you
Non-custodial of funds	Your balances stay on your exchange account and/or your wallet. Chatito does not take those assets into a Chatito pot.
Credentials, not balances	For always-on bots we may store encrypted trade credentials so the system can place orders on your instruction.
You arm Live	Saving a key is not the same as going live. Turning on real-money trading is always your decision.
No seed phrases	We never ask for BIP39 recovery words. Never paste a seed into Chatito (or anywhere else).

What Chatito Does Not Do

Does not hold your exchange balances as a deposit-taker
Does not ask for seed phrases or recovery words
Does not auto-switch Live because a key was saved
Does not let AI agents mint live-trade powers
Does not want your main bankroll private key pasted into Settings

If a flow ever asked for a seed phrase, that would be wrong - close it and treat it as a security incident.

Three Different Kinds of “Keys”

People mix these up. Chatito treats them differently on purpose.

1. Exchange API keys (CEX automation)

What they are: keys you create on Binance (or another venue) so software can trade inside your exchange account.

Where the money sits: still on the exchange, under your account.

What Chatito stores: the API key material, encrypted at rest, so a strategy can place orders when you arm Live.

What you should create: trade-only keys - turn off withdraw and cash-out powers. Prefer a dedicated automation key, not the same key you use for everything.

How “signing” works here: the exchange owns the signature scheme. Chatito unwraps your encrypted secret only when a trade path needs to call the venue, authenticates that request, and does not keep funds on Chatito.

Think of it like giving a limited remote control for trading - not handing over the vault door.

2. Wallet signatures (login and on-chain actions)

What they are: you approve a message or a transaction in your wallet (browser extension, hardware, etc.).

Where the money sits: in your wallet / on-chain positions you control.

What Chatito stores: for login, typically the wallet address after a signature check - not your private key.

LP-style live (when that product path is open): the platform can propose the transaction steps; you sign each step in your wallet. The server does not hold a private key to broadcast for you.

This is the strongest “self-custody” picture: propose → you sign → chain executes.

3. Things we refuse or keep closed for multi-user live

Material	Policy
Seed phrases	Never accept, never store
Main wallet private keys	Not a product path - do not paste them
Server-held chain private keys for many users	Not how multi-user live is designed today; on-chain multi-user live needs a dedicated, safer design (prefer wallet sign or a small dedicated automation wallet - never your main seed)

How Encryption Works (Human Version)

When you save exchange credentials in Settings → API & Keys:

You send them over HTTPS (encrypted in transit).
The server encrypts them before they land in the database.
Industry-standard AES-256-GCM protects the secret.
We use envelope encryption: each secret gets its own data key; that data key is wrapped by a master key (and can be wrapped by a cloud KMS when production is configured that way).
After save, the app only shows status like configured and a short fingerprint (last4) - not the full secret again.
Decrypt happens on authenticated trading paths that need the venue call - not on random page loads, and not as “export all keys.”
Setting or clearing keys can require extra confirmation (and 2FA when you have it turned on).
When the venue allows, we reject keys that still allow withdraw so trade-only stays trade-only.

What a database dump alone is not: with envelope encryption and proper master/KMS hygiene, ciphertext without the wrap keys is not useful trading access.

We still treat vault material as high sensitivity. Encryption is necessary; it is not a magic shield against a compromised account or a leaked exchange key. Rotate keys on the exchange if you suspect trouble.

What Happens When a Strategy Trades Live (CEX)

A simplified movie of the CEX path:

You create trade-only keys on the exchange
        ↓
You paste them into Settings (HTTPS)
        ↓
Chatito encrypts and stores ciphertext only
        ↓
You arm Live on a strategy (human decision)
        ↓
Worker decrypts only to place that order
        ↓
Exchange executes on your account
        ↓
Funds never sat in a Chatito deposit wallet

Paper strategies skip the live key path entirely - practice money is not venue capital.

What You Should Do

Habit	Why
Use trade-only exchange keys	Limits blast radius if something goes wrong
Prefer a small dedicated automation bankroll	Don’t point automation at your entire net worth
Turn on 2FA in Settings	Protects account actions, including key changes
Clear / rotate keys if a device or password might be compromised	Exchange-side revoke is the real kill switch
Never share keys in chat, Telegram, or email	Support will not ask for full secrets in DMs
Practice on paper first	Live is a separate, deliberate step

Keys live in the product under Settings. Protect them the same way you protect banking passwords.

How This Differs From a Custodian

Custodial model	Chatito model
You deposit assets into a company wallet or omnibus	You keep assets on your exchange or your wallet
Company can move funds as the custodian	Company does not take deposit custody of those balances
Recovery often depends on the custodian	Revoke happens on your venue / wallet; Chatito vault clear is extra

Storing encrypted API credentials so software can trade for you is normal for strategy bots. That is not the same product as “send us your crypto and we hold it.”

If you need institutional multi-party custody (MPC / HSM / Fireblocks-class), that is a later scale conversation - not what everyday self-custody automation is built on today.