Security
What CentraFIN can and can't see, how your keys and wallets are protected and how to report a vulnerability to us.
CentraFIN is designed so that even a breach of our servers would not let anyone touch your money or uncover your private wallets.
What our servers see
| Data | Our servers |
|---|---|
| Balances, positions, orders and history from your platforms | See them, to display and calculate your figures |
| Your API key secrets | Keep them encrypted (AES-256-GCM); never send them back, display them or log them |
| Your Hyperliquid account address | See it: it is used to read the account |
| Public keys, addresses, names and balances of your Bitcoin wallets | Never see them: your browser encrypts them |
| Private keys and recovery phrases | Never receive any: the service accepts none |
| Passwords | The service uses none: passkeys and one-time codes instead |
Read-only keys
- CentraFIN places no orders, transfers nothing and withdraws nothing.
- Coinbase and OKX: every new key is checked with the platform; a key that can trade, transfer or withdraw is rejected.
- Kraken: the platform doesn't allow this check. The dialog for adding a key lists the only permissions to turn on.
- Hyperliquid: no key; the account is read through its public address, and an API wallet address is rejected.
- Interactive Brokers: a Flex Query token, which only gives access to statements.
- Secrets are encrypted with the service's own key, bound to their key type and never leave our servers.
A fixed IP address for your keys
Calls to Kraken, Coinbase, OKX and Hyperliquid all go out from a single address, our relay's: 130.110.240.91. You can restrict your API keys to this address on the platform: a stolen key would then be useless anywhere else.
The relay, hosted in France, only accepts requests signed by CentraFIN, only calls these platforms and keeps nothing. It sees their responses pass through, never a secret.
Private wallets we can't read
- A wallet is added by its account's public key (xpub, ypub, zpub), never by a private key.
- Your browser encrypts your wallets (AES-256-GCM) with a key protected by your passkey (WebAuthn PRF extension). Our servers only store encrypted data they can't open.
- Your browser reads the balances itself from public Bitcoin nodes (blockstream.info, mempool.emzy.de, mempool.bitaroo.net), over an end-to-end encrypted connection, through a blind relay. These nodes see the addresses requested, but neither your IP address nor your account. Each address is always read by the same node: none of them sees them all.
Passwordless sign-in
- Your email address, confirmed when the account is created, receives a sign-in link each time you ask for one. It works for 15 minutes, once, and opens with a button: software that scans your emails can't use it in your place.
- You can add a passkey (WebAuthn, user verification required), an authenticator app (6-digit codes) or both. With the app, its code is asked for after the link; with a passkey alone, the passkey is asked for after the link. Your inbox alone doesn't open an account protected this way.
- A passkey also signs you in without email, followed by the code if you have the app.
- An email address receives at most one link a minute and five an hour, and an IP address can ask for at most ten an hour.
- After 5 wrong codes in a row, the account waits 15 minutes, then twice as long after each new series, up to one day. A single IP address is blocked after 5 failures in 15 minutes.
- A session lasts 8 hours.
- Your account only opens with your sign-in methods: no one, CentraFIN included, can get in without them. Protect your inbox, and keep two passkeys if you use them.
AI assistants (MCP)
- An assistant can only access your account if you authorise it (OAuth 2.1 with PKCE), read-only, and never your private wallets.
- Its access token is valid for 1 hour; its refresh token for 30 days, and it can only be used once.
- You can revoke an assistant at any time in the settings.
The site itself
- No third-party scripts, no ads, no analytics tools.
- A strict Content Security Policy, and HTTPS connections only.
Reporting a vulnerability
Email contact@centrafin.xyz with “Security” in the subject line: what you found, how to reproduce it and what you were able to see. Don't access other people's data, don't degrade the service and give us time to fix the issue before you publish. These rules are also in our security.txt file.