How Flowsense protects your keys and data
Read-only sync keys, trading that can never withdraw, and encryption bound to your account.
Updated 1 min readAlso available in Português, Español, Français, Deutsch, Türkçe, Tiếng Việt, Bahasa Indonesia
- Sync keys are read-only. Where the exchange reports permissions (Binance, Bybit, OKX, Bitget), keys that can trade or withdraw are refused. MEXC asks you to confirm. Hyperliquid needs no key at all.
- Trading can't withdraw. When you turn on trading for a connection, keys with withdrawal or transfer permission are refused, and permissions are re-checked before every order.
- Encryption. API keys, secrets, passphrases and webhook URLs are encrypted at rest with AES-256-GCM, bound to your account, so a key copied to another account can't be decrypted.
- You confirm every order. The desk and copier never place an order without your click.
- Payments are handled by Stripe; Flowsense never sees your card.
Never share your exchange secret keys with anyone, including people claiming to be Flowsense support. We will never ask for them outside the Integrations page.
Questions
- What should I do if I think a key leaked?
- Delete the key on the exchange first, then remove or edit the connection in Flowsense.
- Can Flowsense staff see my keys?
- Keys are encrypted and only decrypted on the server to call the exchange for you.
Related articles
- Turn on trading for a connectionLet the Trade Desk place orders through your exchange connection, with a key that can never withdraw.
- Connect Binance with a read-only keySync your USDⓈ-M futures trades every hour with a key that can only read.
- Export your data or delete your accountDownload every trade as a CSV any time, or erase everything.