Security
What CentraFIN can and can't see, how your keys and wallets are protected, and how to report a vulnerability to us.
CentraFIN is designed so that even a breach of our servers would not let anyone touch your money or uncover your private wallets.
What our servers see
| Data | Our servers |
|---|---|
| Balances, positions, orders, and history from your platforms | See them, to display and calculate your figures |
| Your API key secrets | Keep them encrypted (AES-256-GCM); never send them back, display them, or log them |
| Your Hyperliquid account address | See it: it is used to read the account |
| Public keys, addresses, names, and balances of your Bitcoin wallets | Never see them: your browser encrypts them |
| Private keys and recovery phrases | Never receive any: the service accepts none |
| Passwords | The service uses none: passkeys and one-time codes instead |
Read-only keys
- CentraFIN places no orders, transfers nothing, and withdraws nothing.
- Coinbase and OKX: every new key is checked with the platform; a key that can trade, transfer, or withdraw is rejected.
- Kraken: the platform doesn't allow this check. The dialog for adding a key lists the only permissions to turn on.
- Hyperliquid: no key; the account is read through its public address, and an API wallet address is rejected.
- Interactive Brokers: a Flex Query token, which only gives access to statements.
- Secrets are encrypted with the service's own key, bound to their key type, and never leave our servers.
A fixed IP address for your keys
Calls to Kraken, Coinbase, OKX, and Hyperliquid all go out from a single address, our relay's: 130.110.240.91. You can restrict your API keys to this address on the platform: a stolen key would then be useless anywhere else.
The relay, hosted in France, only accepts requests signed by CentraFIN, only calls these platforms, and keeps nothing. It sees their responses pass through, never a secret.
Private wallets we can't read
- A wallet is added by its account's public key (xpub, ypub, zpub), never by a private key.
- Your browser encrypts your wallets (AES-256-GCM) with a key protected by your passkey (WebAuthn PRF extension). Our servers only store encrypted data they can't open.
- Your browser reads the balances itself from public Bitcoin nodes (blockstream.info, mempool.emzy.de, mempool.bitaroo.net), over an end-to-end encrypted connection, through a blind relay. These nodes see the addresses requested, but neither your IP address nor your account. Each address is always read by the same node: none of them sees them all.
Passwordless sign-in
- A passkey (WebAuthn, user verification required), an authenticator app (6-digit codes), or both.
- After 5 wrong codes in a row, the account waits 15 minutes, then twice as long after each new series, up to one day. A single IP address is blocked after 5 failures in 15 minutes.
- A session lasts 8 hours.
- Your account only opens with your sign-in methods: no one, CentraFIN included, can get in without them. Keep two of them, for example two passkeys.
AI assistants (MCP)
- An assistant can only access your account if you authorize it (OAuth 2.1 with PKCE), read-only, and never your private wallets.
- Its access token is valid for 1 hour; its refresh token for 30 days, and it can only be used once.
- You can revoke an assistant at any time in the settings.
The site itself
- No third-party scripts, no ads, no analytics tools.
- A strict Content Security Policy, and HTTPS connections only.
Reporting a vulnerability
Email contact@centrafin.xyz with “Security” in the subject line: what you found, how to reproduce it, and what you were able to see. Don't access other people's data, don't degrade the service, and give us time to fix the issue before you publish. These rules are also in our security.txt file.