Security Architecture

Zero-Knowledge
Architecture

Your exchange keys live only on your own dedicated VPS. We run the hardware — we never touch the secrets.

Start your dedicated VPSSee how it works

The data flow, end‑to‑end

live · single‑tenant · EU
① SECRETS PATH — one-way write over TLS
keys go straight into your VPS container · never stored on, or logged by, the control plane
⑤
②
③
④
⑥ no network path
CLIENT
You
browser · dashboard
• Paste API keys once• Manage bots & backtests• Telegram control
ORCHESTRATION
FreqEdge Control Plane
provisioning · monitoring · billing
• Provisions your VPS via cloud-init• Deploys signed container images• Monitors health, restarts crashed bots• Billing, plans & Copilot credits
sees metadata & masked fingerprints only
ISOLATED · SINGLE-TENANT
Your Dedicated VPS
EU datacenter (Germany) · yours alone
Docker containers
freqtrade · plain-English (CCXT) · webhook relay
Strategy files (.py) — your IP
live on your VPS; sent to the control plane only when you invoke a Copilot skill
Exchange API keys
AES-256 at rest · memory-only at runtime · withdraw = rejected
✗ port 22 closed  ·  no FreqEdge SSH keys on host  ·  agent outbound-only
VENUE
Exchange
Binance · Kraken · Bybit · OKX …
orders signed & sent from YOUR VPS
① secrets: one-way write over TLS② signed commands only (no shell)③ telemetry only: CPU, RAM, status④ orders — FreqEdge never in the path⑤ dashboard traffic (UI, billing)⑥ no path from control plane to exchange

What we can — and cannot — see

The boundary isn't a promise. It's the way the system is built.

✓We can see
✓Email & billing records
✓VPS metadata — region, size, uptime
✓A masked key fingerprint
✓Health metrics: CPU, RAM, bot status
✓Copilot message log when you invoke a skill (strategy snippets sent for that request)
✗We cannot see — by design
✗Your exchange API secrets — encrypted at rest on your VPS, memory-only at runtime
✗Shell / SSH access (port 22 closed; agent outbound-only)
✗Any withdrawal capability — withdrawal endpoints are never called
✗Strategy code sitting idle on your VPS — only transmitted when you invoke a Copilot skill

Strategy code nuance: files live on your VPS. When you invoke a Copilot skill (narrate, debug, generate), the relevant snippet is sent to the orchestrator for that request and a message log is kept. Secrets — exchange API keys — never leave your VPS.

Your keys stay on your VPS

Exchange API keys are encrypted at rest and live only on your dedicated VPS. The orchestrator and FreqEdge staff cannot read them — we never see your key material in plaintext.

Per-VPS isolation

Every customer gets a dedicated Hetzner server — no shared runtime, no multi-tenant containers holding your keys or code next to another customer's.

Per-VPS Copilot token binding

Each VPS signs its AI Trading Copilot requests with a unique secret. A compromised VPS cannot spend another tenant's credits — the orchestrator verifies both the signature and the account it claims to be acting for before charging anything.

TLS everywhere

The orchestrator and every per-VPS terminal are served over HTTPS, with certificates provisioned and renewed automatically.

Key lifecycle

From paste to destroyed

1
Paste keys
Entered once in your dashboard, after your VPS is live.
2
Written to your VPS
One-way over TLS — never to the control plane.
3
Permissions checked
Withdrawal-enabled keys are rejected.
4
Only a masked fingerprint kept
Plus a "no-withdraw ✓" flag on the orchestrator.
5
Cancel → destroyed
VPS & keys wiped in a 7-day GDPR window.
AES-256
Encrypted at rest
Memory-only at runtime
EU / DE
German datacenter
Single-tenant, yours alone
GDPR
Right to erasure
7-day deletion window
PORT 22
No shell access
No FreqEdge SSH keys on host

What FreqEdge cannot do

Not "we promise not to" — the architecture doesn't give us the ability.

Withdraw funds. FreqEdge never calls a withdrawal endpoint — and we recommend creating API keys with withdrawals disabled, so even a compromised key can't move funds.

See your exchange API keys. They're encrypted at rest on your own VPS, not the orchestrator.

Deploy code without your confirmation. Every generated or uploaded strategy passes an AST sandbox, and going live from paper/dry-run always requires a typed confirmation.

One thing you control: how the key is created

When you create an exchange API key, disable withdrawal permissions before pasting it into FreqEdge. Combined with our own withdrawal-endpoint ban, this means a compromised key — yours or ours — still can't move funds out of your exchange account.

Trade with keys only you control

Spin up a dedicated, single-tenant VPS in the EU. Your secrets never leave it — not even to us.

Start your dedicated VPSRead the security FAQ

Found a security issue?

We take responsible disclosure seriously. Email us and we'll respond as quickly as we can.

security@freqedge.io

Questions about billing, GDPR, or account data? See the Security & Privacy FAQ.