Security

Security is non-negotiable

We protect your accounts the same way top-tier exchanges protect theirs — because anything less would put your capital at risk.

We require — and only accept — exchange API keys without withdrawal permissions. Your funds never leave your exchange.

All API secrets are encrypted using AES-256-GCM and stored inside an AWS KMS-backed HSM. Decryption happens only inside the execution sandbox.

Every connection — browser, mobile, exchange API — is wrapped in TLS 1.3 with HSTS preload and certificate pinning.

Audited annually by Drata for security, availability, processing integrity, confidentiality, and privacy controls.

Anomaly detection on every account. Suspicious login locations or unusual trade patterns trigger instant 2FA challenges and email alerts.

We pay up to $50,000 for verified critical vulnerabilities. Report to security@teracore.io or via HackerOne.

Found a security issue? We pay competitive bounties for responsible disclosure and respond to every report within 24 hours.