Security & Privacy

Every DeFi Orbit product reads public blockchain data. None of them can sign or submit a transaction.

• We never request private keys, seed phrases or transaction approvals
• You can track any address without connecting a wallet. To prove you own a wallet, you sign a short text message, which cannot move funds or approve anything
• Every API endpoint and every DeFi Orbit AI tool returns data only: none can move funds
• Your assets stay under your control at all times

We sort the data in our care by how much harm its disclosure could cause, and handle each class accordingly.

2.1Restricted

Account credentials, API key secrets, billing details, referral payout details and Portfolio Enterprise client records. Access is limited to named staff who need it, and the data is encrypted in transit and at rest.

2.2Confidential

Account information, the wallet addresses you track, alert settings including Telegram chat IDs, usage and request logs, and support conversations. Access is limited to staff with a business need.

2.3Internal

Operational data such as system metrics and internal documentation. Not shared outside the company.

2.4Public

On-chain data, published documentation and marketing content. Protected against unauthorised changes, but free to disclose.

We use encryption for:

• Data in transit, over TLS
• Sensitive data at rest, including API key secrets and billing data
• Communication between our internal services
• User authentication

4.1Least privilege

Staff get access to systems and data only as their role requires, through individual accounts tied to each person.

4.2Authentication

Multi-factor authentication is required for production systems, cloud consoles and admin tools.

4.3Reviews and offboarding

Access rights are reviewed regularly and removed promptly when someone changes role or leaves.

4.4Your API keys

You control your own keys: create separate keys per environment, review usage and request logs, and revoke a key at any time from the API Platform. Rate limits apply to every key.

4.5Your team and clients

In Portfolio Enterprise, each client sits in its own sub-account and sees only the wallets you assign. Share links can be turned off at any time, and access for your team follows the seats and settings on your account.

• Production runs on managed cloud infrastructure with network-level access controls
• Systems and dependencies are patched on a regular schedule
• Code changes are reviewed before they reach production
• Secrets are kept in a managed secrets store, never in source code
• Rate limiting and abuse detection protect the API and the app
• Traffic and logs are monitored for unusual activity

DeFi Orbit AI is our hosted MCP server. It uses the same API keys, rate limits and logging as the API, and all of its tools are read-only.

• Data is returned only to the assistant that made the request
• The server never holds wallet keys, so an agent has nothing to act with
• Once data reaches your assistant, its model provider’s terms apply, so choose a client whose data terms you are comfortable with

We use a small number of vetted providers to run the service, each limited to the data it needs:

• Payment processing. We do not store full card numbers
• Email delivery, and Telegram for alerts you turn on
• Cloud hosting and storage
• Blockchain nodes and market data providers, which receive public on-chain queries only

Live status and incident history are published at status.defiorbit.xyz. Customer data is backed up regularly, and restores are tested. Uptime commitments apply only where agreed in a signed order form.

If we detect or are told about a security incident, we:

• Contain it and assess what was affected
• Investigate and document the cause
• Notify affected customers and regulators without undue delay, as required by law, with what happened and what we are doing about it
• Fix the cause and update our controls to prevent it happening again

If you believe you have found a vulnerability in DeFi Orbit, email security@defiorbit.xyz with the steps to reproduce it. We acknowledge every report and keep you updated until it is resolved.

When testing, please:

• Give us reasonable time to fix the issue before disclosing it publicly
• Use only your own accounts and API keys
• Not access, change or delete other users’ data
• Not run denial-of-service attacks or social-engineer our team

We will not take legal action against researchers who follow these rules in good faith.

How we collect, use, share and retain personal information, and your rights over it, are set out in our Privacy Policy.

We review these practices regularly and update this page when they change. The date at the top shows the latest revision.