We never request trade or withdrawal permissions. Not now, not ever in this phase.
Everything stays in your own accounts, on your own terms. Survol connects to the exchanges, wallets, and DeFi protocols you already use — it never becomes a custodian, an intermediary, or a place your funds actually sit. If Survol disappeared tomorrow, every asset it shows you would still be exactly where it already was: in your own accounts.
Every exchange connection uses API keys scoped to read-only permissions — balances and trade history, nothing else. No trade authority, no withdrawal authority, ever. Wallet and DeFi positions are read directly from public on-chain data, the same information anyone could look up given your address, not a permission you grant.
A leaked or compromised Survol account can expose what you hold — never move it. There is no trade or withdrawal endpoint in the product for an attacker to reach, because Survol’s own connectors never request that scope from the venue in the first place.
API keys and secrets are encrypted with AES-256-GCM the moment they reach Survol’s servers — authenticated encryption, not just obfuscation, so any tampering with the stored ciphertext is detectable, not just the contents hidden. The encryption key lives only in server-side environment configuration, never in the database alongside the data it protects.
The credentials table itself carries no direct access grants for the application’s regular database role — reading a credential requires going through a single server-side code path that checks your own session first. There is no query a compromised front-end session could run to read another user’s — or even your own — raw credentials directly.
Read-only, encrypted, and never able to trade or withdraw on your behalf.