Trust

Security

How we handle your keys, your data, and your sessions.

Key encryption

Private keys for custodial and imported wallets are encrypted with AES-256-GCMbefore storage. The encryption key is derived server-side and never leaves the backend. Even if the database leaked, raw keys would be unreadable.

Transport

TLS everywhere — every connection is encrypted in transit
HSTS — forces HTTPS, prevents downgrade attacks
Security headers — HSTS, X-Frame-Options, X-Content-Type-Options and X-XSS-Protection are set on every response
Content-Security-Policy — not yet enforced. A policy is defined but ships in report-only form, so it does not currently block anything. Enforcing it requires nonce-based script loading, which is in progress

Authentication

Sessions use JWT tokens via NextAuth v5. Sign-in is either Google OAuth or a wallet signature: the server issues a single-use nonce, the wallet signs it withpersonal_sign (EIP-191), and the recovered address must match the one claiming the session. The nonce is what prevents a captured signature being replayed.

Rate limiting

Seven tiers, applied per IP over a rolling 60-second window. The more damage an endpoint can do, the tighter the budget:

Endpoint	Limit
General API	120 / min
Heavy queries	40 / min
Billing	40 / min
Order placement	30 / min
Bot orders	30 / min
Authentication	20 / min
Sensitive (key reveal, withdrawals)	6 / min

Smart contracts

All trades settle through Polymarket's smart contracts on Polygon. The Conditional Token Framework (CTF) and Exchange contracts are public and verified on-chain. Hexio never takes possession of your funds as a balance on our books — your positions are held by those contracts, against your own address.

What custody actually means here. For a linked wallet the private key never leaves your browser and we could not move your funds if we wanted to. For a custodial or imported wallet we hold the encrypted key, which means the server can sign transactions for that address — that is what lets it trade on your behalf. Encryption protects the key from a database leak; it does not make the wallet self-custodied. If you want a wallet we cannot sign for, link one.

Infrastructure

RPC failover — multiple Polygon RPC endpoints with automatic switching
WebSocket heartbeats — stale connections detected and recycled
Encryption at rest — wallet private keys and API secrets are stored encrypted; other columns are not individually encrypted
Audit log — sensitive actions (key reveal, withdrawals, wallet changes) are recorded