Security and your funds
In short
Your wallet signs every movement of funds. We hold one trading key for your Strike account, encrypted, and delete it when you disconnect. We never see your wallet's keys or recovery phrase.
Your money stays in your wallet or in your own Strike account. strikeabox never holds it.
What we can and can't do
- Place and cancel orders for your live boxes
- Read your balance and history
- Ask Strike for a deposit or withdrawal for your wallet to sign
- Move funds without your signature
- Choose where funds go
- Change Strike's transaction
- See your wallet keys
Deposits go only to Strike's vault, and withdrawals only to the wallet you connected. Both addresses come from Strike. Your wallet gets Strike's transaction exactly as Strike built it, and shows you the amount and address before you sign.
How the key is kept
Made on our server, encrypted at rest (AES-256-GCM), never sent to your browser or logs, deleted when you disconnect. The encryption is tied to your account, so a stored key can't be moved to anyone else's.
Why on our server at all? A live box must close at its deadline, even with your app closed. The server can only do that if it can sign orders for you.
Disconnect and revoke
- Disconnect deletes the key at once. There is no copy, so nobody, including us, can sign with it again. Close your open boxes first: see Disconnect.
- Revoke it at Strike too, if you like. Open the Strike testnet app with the same wallet and remove the strikeabox API wallet.
- Reconnecting replaces the key. Strike revokes the old one, so only one strikeabox key is ever active on your account. If Strike revokes or expires it, Live asks you to connect again.
What we never hold
No seed phrases, wallet private keys, passwords, emails or payment details. You sign in your own wallet; we only receive the signature.
Careful
Nobody from strikeabox will ever ask for your recovery phrase. Anyone who does is not us.