Security
How we protect your account, your keys, and your capital.
Last updated: July 22, 2026
Security is a first-order product concern at SOLARISX AI BOT. This page describes the controls we operate, the assumptions users should hold, and how to report a vulnerability. It is a living document — meaningful changes are noted with the "Last updated" date above.
Encryption at rest & in transit
All traffic is served over TLS 1.2+. Hot-wallet private keys are sealed with AES-256-GCM using per-record nonces before ever touching the database. Backups and object storage inherit the same encryption boundary.
Zero seed-phrase custody
We never ask for, store, or transmit user seed phrases. External wallets remain fully under your control. Managed hot wallets exist only for users who explicitly provision one, and are strictly scoped for automation.
Row-Level Security everywhere
Every table in the application database enforces row-level security. A user's data is unreachable from any other user's session, regardless of client bugs. Admin-only tables require verified role claims.
Least-privilege infrastructure
Server functions run on isolated edge workers with scoped secrets. Service-role keys never reach the browser. Public API routes verify signatures or shared secrets before executing any write.
Continuous monitoring
Structured logs, anomaly detection, and rate-limits guard against abuse. Suspicious authentication patterns trigger automatic session invalidation and, where applicable, KYC re-verification.
Responsible disclosure
Security researchers are welcome. Report vulnerabilities through the in-app support channel with a clear proof-of-concept and impact analysis. We acknowledge reports within 72 hours and coordinate remediation before public disclosure.
1. Authentication
- Password hashes are salted and stretched using industry-standard KDFs — plaintext passwords are never logged.
- OAuth (Google) is available for passwordless sign-in with provider-side MFA.
- Sessions rotate refresh tokens and can be revoked globally by the account owner from settings.
- Standalone PWA launches never inherit an active browser session — every install requires an explicit sign-in.
2. Authorization
- Role-based access control separates normal users from privileged operator roles. Roles live in a dedicated table and are checked by security-definer functions to prevent RLS recursion.
- Privileged server functions verify the caller's role against the authenticated session before touching admin data.
- Public tick endpoints under /api/public require a signed shared secret and are rate-limited.
3. Wallet & Key Management
- Encrypted hot-wallet material is protected by AES-256-GCM. The encryption key is held in server-only secrets and rotated periodically.
- Withdrawal destinations must be pre-saved and are validated against the requested network before broadcast.
- On-chain withdrawals follow a manual approval + 24-hour cooldown to protect against unauthorized drains.
4. Data Handling
- Personal data is minimized and retained only for as long as required by law and contract.
- KYC media is processed by our verification vendor and is not exposed to unrelated staff or systems.
- Analytics telemetry is aggregated; we do not sell or share personal data with third-party advertisers.
5. Operational Security
- Production access is restricted to a small number of authorized administrators using MFA.
- Deployments follow reviewed changes only — no direct writes to production databases.
- Backups are encrypted, versioned, and periodically restored to verify integrity.
6. Reporting a Vulnerability
Please do not exploit findings, publicly disclose issues before they are fixed, or access data beyond the minimum necessary to demonstrate impact. Contact us through the in-app support channel with a clear write-up. We do not currently run a public bounty program, but we recognize meaningful contributions in our security acknowledgements.
No system is perfectly secure. Users remain responsible for safeguarding credentials, MFA devices, and any external wallet seed phrases. When in doubt, sign out on all devices from settings and rotate your password.