Security
Every point below is a claim with a counterpart in the code. We do not state anything we cannot measure; at the end we also list what we do NOT claim.
We never hold your funds
Bilgin Trade holds no custody. Trades open and close in your own exchange account; your balance never moves to us. All the panel does is send orders to that account with the permission you granted.
API keys are sealed in a separate process
Your key is stored encrypted, and the ability to decrypt it lives in a separate sealing process, not in the application server. That process has no endpoint that returns a key — so the claim is not “it cannot decrypt”, it is “there is no door to make it decrypt”.
Keys are never written to logs
Because exchange errors can carry a signature or key fragment, only the exchange name and error class reach the log — never the exchange's raw message.
Keys with withdrawal permission are rejected
Where the exchange lets us read key permissions, a key with withdrawal enabled is rejected without being stored. On exchanges where permissions cannot be read we cannot know, and we record that we do not know — the permission we ask for is always trade only.
Browser side
A strict content security policy, HSTS and framing protection are in force. These are measurements, not claims: you can inspect the response headers yourself in your browser's network tab.
What we do NOT claim
We do not guarantee profit; leveraged trading can lose your entire capital. We do not audit the exchange's own security. We recommend creating your key with an IP restriction on the exchange — that is in your hands, not ours.