Security and API key safety

The design decision everything else follows from

AKQX takes no custody of money. There is no AKQX wallet, no deposit, no balance held on your behalf. If you ever trade for real, the funds stay in your own exchange account and AKQX acts on them only through an API key you created and can revoke.

That single choice removes the largest category of risk a trading platform can carry. A platform that holds funds can lose them, freeze them, or be compelled to hand them over. A platform that holds none cannot. It also means the worst case here is not “AKQX takes your money” — it is “a strategy you deployed traded badly”, which is a risk you can measure and bound, and which the whole backtest and paper trading sequence exists to reduce.

API key safety, in order of importance

If you read nothing else on this page: never enable withdrawal permission on an API key you give to any trading platform, this one included. AKQX does not need it and cannot use it.

• Read and trade permissions only. That is everything AKQX requires to place and track the orders your algos generate.
• Withdrawals disabled. With withdrawal permission off at the exchange, no software holding that key can move funds out, regardless of what happens to the software.
• IP allow-listing where your exchange offers it, so the key only works from expected addresses.
• A dedicated sub-account where your exchange offers one, so the key's reach is bounded to capital you have deliberately allocated.
• Revoke rather than trust. Remove a key from AKQX, or delete it at the exchange, and whatever was using it stops. You never need anyone's cooperation to cut access.

Keys are stored encrypted at rest and are not displayed back in full once saved. They are used only for the orders your deployed algos generate; no key is used for anything you did not deploy.

Account security

Two-factor authentication uses an authenticator app, set up by scanning a QR code. Once on, signing in needs your password and a time-based code. If you connect a live exchange account, enable this first — an API key is only as protected as the account that can reach it.

Signed-in device list. Your account lists every active session and lets you sign any of them out. This is the mechanism for revoking a device you have lost or no longer use. Sessions run on a sliding window rather than lasting indefinitely.

Sign-in options include email with a one-time code and Google sign-in, so you can avoid managing another password if you prefer.

Trade integrity

For real crypto trades, AKQX reconciles its own record of positions and fills against the broker's records rather than trusting what it believes it sent. This matters because the failure mode it catches is a quiet one: a platform that thinks a position is open when it is not, or vice versa, will keep making decisions on a false picture until something forces a correction.

Operational alerts cover the related failures — stale market data, a stale broker balance, order rejections and insufficient margin — and are described in full on the risk management page. The relevant behaviour for this page is that AKQX skips a signal rather than trading on prices it knows are stale.

What AKQX does not claim

Nor is there any claim that the platform cannot fail. Software has bugs, servers have outages and exchanges have both. What the no-custody design does guarantee is narrower and more useful: a failure here cannot move your funds, because nothing here has permission to.

Reporting a vulnerability

Email founder@akqxquantum.tech with enough detail to reproduce the issue. Please allow a reasonable period for a fix before publishing. Reports go to the founder directly.

Please do not test against other people's accounts, and do not run load or denial-of-service tests against the live platform. A free account is enough to test anything worth reporting.

Questions about security

Related pages