Chatito

Security

Chatito is a trading and agent platform. Weak security is not tech debt - it is business-ending risk: account takeover, cross-tenant access, live key leak, or billing compromise.

This page describes how we practice security at a high standard. It is not a compliance certificate, not a bounty program, and not financial advice.

For product risk language and access gates, also read Safety and Access. For who holds funds and how keys are stored and signed, read Custody and Keys.

Principles We Do Not Bend

Principle In plain English
Money first Paths that touch capital, keys, and live trading get priority over polish.
Human owns Live Turning on real money is always your decision. Wizards and agents do not auto-arm Live.
Paper before Live Learn and invent on practice money. Live is a separate, stricter program.
Fail closed If something is misconfigured or not ready, access is denied - not quietly opened.
Tenant isolation Your strategies, ledgers, and agent keys stay yours. Cross-user reads must fail cleanly.
No silent security Real issues are filed, fixed, and re-checked - not forgotten after a one-off fix.
Honest residual risk We track what is still open. We do not market "perfect security."

Institutional-Grade Practices (What We Actually Do)

These are operating practices, not a logo on a homepage.

1. Defense In Layers

  • Identity: you sign in; your session is the root of what the product will do for you.
  • Secrets: trade keys and sensitive material are vault-oriented - Settings does not hand back full secrets as plaintext.
  • Authorization: every trading and agent path checks who you are and what you own.
  • Agent surface: Agent API keys default to read; paper scopes are optional; live trade scopes are not available.
  • Ship discipline: money and auth surfaces change carefully; production is not a casual playground.

2. Money Fortress Mindset

Live capital is treated as a fortress - not because we want ceremony, but because your money and keys deserve a higher bar than paper practice.

From your side of the wall, that means:

  • Your keys stay protected. Exchange and wallet material is stored for use by the platform under encryption-oriented vault rules. The product is built so full secrets are not casually re-displayed.
  • Live is something you turn on. Practice strategies can run without real capital. Going Live requires a clear action from you - not an agent, not a wizard auto-switch.
  • Your book is yours. Strategies, ledgers, and agent keys are isolated per account. Another user (or another agent key) should not read your private trading state.
  • Agents cannot spend live for you. Automation can help with research and paper. Live trade is not a scope agents can mint.
  • Safer defaults when unsure. If Live or sensitive setup is not ready, the product fails closed (denied) rather than "maybe open and hope."
  • Public pages stay clean. Pricing and catalog surfaces are not used as a place to expose sensitive payment or custody configuration.

In short: the fortress is your isolation, your keys, and your live switch - with the platform built to refuse unsafe shortcuts.

Funds vs credentials: Chatito does not take deposit custody of your venue balances. The full plain-language story (CEX encrypted keys, wallet signatures, what we refuse) is on Custody and Keys.

3. Continuous Security Work

Chatito runs a standing security program: reviews, findings, regression checks, and ongoing hardening on live services.

  • Serious issues are fixed or explicitly accepted - not buried.
  • Known-fixed classes are re-checked with tests, not assumed forever.
  • What we learn becomes lessons so standards rise over time. High security is the goal; learning is how the bar keeps moving up.

4. Public Bounty Timing

A half-hearted public whitehat campaign is worse than none. External bounty / prize campaigns, if any, open only when the product is in Beta with real stakes and a serious severity-to-reward process.

5. Self-Learning Loop

Security work is expected to compound:

  1. Load prior findings and lessons for the surface under test.
  2. Prefer money and identity blast radius when time is limited.
  3. File every hit. Fix Critical/High when safe.
  4. Add regression proof. Promote repeated checks into automated smokes.
  5. Never "prove" security by disabling production auth requirements.

What You Control As A User

Control Where Why it matters
Sign-in App login Your session is the root of access
2FA Settings - Security Extra lock on your account
Keys and wallets Settings Prefer dedicated exchange keys with least privilege; never share
Live arm Strategy / venue power Practice first; Live only when you mean it
Agent API keys Settings - Agent API Treat chk_… like passwords; revoke if leaked; scopes never include live trade
Notifications Settings Default quiet; opt in only to what you want
Share and referrals Product share flows You initiate media and caption; we do not auto-post for you

Agent And Automation Surface

Chatito is infrastructure for AI agents as well as humans. That expands the attack surface, so rules are strict:

  • Keys are Bearer tokens (chk_…).
  • Default scope is read. Paper trade is opt-in.
  • Live trade is never mintable on agent keys.
  • Webhooks and MCP inherit the same ownership rules as the Agent API.
  • Machine-readable truth: chatito.ai. Human orientation: AI Agents.

What We Will Not Claim

  • Guaranteed safety or "unhackable" systems
  • That practice results equal live results
  • That we are SOC 2 / ISO certified solely because we document practices (certifications are separate scale work)
  • That every residual is zero - defense-in-depth items may remain open and tracked
  • That screenshots or Docs override what the live app shows for access gates

How This Relates To Product Honesty

Security is part of product trust, not a separate brochure:

Related