> For the complete documentation index, see [llms.txt](https://docs.vooi.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vooi.io/vooi-security.md).

# VOOI Security

## Overview

VOOI is designed to minimize exposure of sensitive credentials when users connect wallets and trading venues.

**VOOI does not custody user funds.** Funds remain in the user’s wallet or on the connected trading venue.

Connecting a wallet or trading venue does not transfer funds to VOOI.

## How VOOI Access Works

### 1. Sign In to VOOI

<div align="left"><figure><img src="https://3071033198-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXCba6CdwFKbzdASxvC5H%2Fuploads%2FGNv0uH5LZmqJusKeJj14%2Fimage.png?alt=media&amp;token=ef4a07f5-304e-4f5a-a598-957feb419406" alt="" width="563"><figcaption></figcaption></figure></div>

To sign in to VOOI, the user connects a wallet and signs a message.

The signature confirms that the user controls the wallet address. **Signing this message does not transfer funds or give VOOI access to wallet assets.**

VOOI never receives or stores the wallet private key or seed phrase.

After signing in, the user can access VOOI and connect supported trading venues.

### 2. Connect a Trading Venue

<div align="left"><figure><img src="https://3071033198-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXCba6CdwFKbzdASxvC5H%2Fuploads%2FYE5fYDu7maoyXMbNeKNx%2Fimage.png?alt=media&amp;token=3f03bf48-79f7-4579-a5b0-7b9b0d64545e" alt="" width="563"><figcaption></figcaption></figure></div>

To trade through VOOI, the venue must also be connected or enabled.

How this works depends on the venue:

* **Wallet authorization:** some venues require the user to sign a venue-specific trading authorization with the connected wallet. This allows the user to place and manage trades on that venue through VOOI.
* **API connection:** other venues are connected using an **API Key** and **API Secret** created on the venue. VOOI can only perform actions allowed by the permissions enabled for that API key.
* **Deposit first:** some venues require an initial deposit before the trading account is created or activated. Once the funds arrive, the user can complete the connection and trade on that venue through VOOI.

Connecting or enabling a venue **does not transfer funds to VOOI**. Funds and positions remain on the connected venue.

### 3. Trade Through VOOI

Once the user is signed in and a venue is connected, the user can place and manage trades on that venue through the VOOI interface.

Orders are executed on the connected venue, where the user’s funds and positions remain.

For automated features, such as Arbitrage Bots, trading is performed according to the strategy and settings selected by the user.

**VOOI does not custody the user’s funds at any stage.**

## Security Controls

VOOI combines multiple security controls:

**Encrypted credential storage +**\
**Isolated key vault +**\
**Restricted access +**\
**Signing inside the vault+**\
**Monitoring and audit**

**Exchange credentials are isolated from the main VOOI infrastructure.** The main application and database do not store exchange secrets directly. Credentials are decrypted and used inside the dedicated key vault only when they are needed to authorize a request.

This separation is designed to limit the impact of a compromise in other parts of the VOOI infrastructure: access to the main application or database alone should not expose exchange secrets.

## Exchange API Security

Some trading venues, such as Binance, MEXC, Bybit, and Gate, are connected to VOOI using **API credentials**, typically an **API Key** and **API Secret**.

These credentials are stored in a dedicated key vault isolated from the main VOOI application and database. The main VOOI services work with a credential reference rather than directly storing the exchange secret.

### How API Credentials Are Protected

Exchange credentials are:

* **Encrypted before they are stored;**
* Kept in a dedicated key vault separate from the main application infrastructure;
* Decrypted only when required for an authorized operation;
* Used for signing requests inside the key vault rather than being returned to the main application.

Encryption keys are managed through **AWS Key Management Service (AWS KMS)** and are kept separate from the stored credentials. A copy of the key-vault database alone contains encrypted data and does not provide usable exchange credentials.

The key vault is also isolated at the network level and is not exposed through a public IP address.

Security-sensitive access and administrative activity are monitored and audited.

### API Permissions

When creating an API key for VOOI, only the permissions listed in the corresponding VOOI setup guide should be enabled.

Required permissions differ between venues and may also depend on the features being used.

Where supported, VOOI setup guides provide **IP addresses that can be added to the API key allowlist.**

Permissions that are not required for the integration should not be enabled.

## Revoking Access

The user remains in control of connected accounts.

If VOOI access to a venue is no longer required, the corresponding API key can be revoked or deleted directly on the venue.

Wallet-based venue permissions, such as trading authorizations created by signing with a connected wallet, can be revoked through the relevant venue or wallet where the authorization is managed.

## Security Best Practices

For additional protection:

* Create a separate API key specifically for VOOI;
* Enable only the permissions required by the VOOI setup guide;
* Use an IP allowlist where supported;
* Enable **2FA** and other security features offered by the venue;
* **Never share a wallet private key or seed phrase** with VOOI, support staff, or anyone else;
* Review wallet signatures and transactions before approving them.