Security & Safety

Your exchange API keys are the most sensitive thing you’ll ever hand to a trading terminal. This page explains exactly what ZoneX does — and does not do — with them, so you can connect with confidence.

Your funds never leave the exchange

The single most important protection is one you control when you create your API key on the exchange: do not enable the Withdrawal permission.

ZoneX has no withdrawal feature. It never requests, needs, or uses withdrawal access. When you create a key with only Read and Trade permissions:

• Orders can be placed and positions managed on your behalf — inside the exchange.
• No one can move your balance off the exchange to an external wallet.

This is your safety net

Even in the worst case — a compromised key or a breach — an attacker who only has a Read + Trade key cannot withdraw your funds. They can trade, but they cannot make your money disappear from the exchange. Withdrawal always requires a permission ZoneX never asks for.

Exchange permission	ZoneX needs it?	What it allows
Read	Yes	Fetch balances, positions, and order history
Trade	Yes	Place and manage orders
Withdrawal	No — leave it OFF	Move funds off the exchange (never used by ZoneX)

See Connecting an Exchange for the step-by-step setup.

How your API keys are stored

When you connect an exchange account, your API key and secret are encrypted at rest before they ever touch the database.

ZoneX encrypts your credentials with a dedicated encryption service using strong, industry-standard AES-256 encryption before they are stored. Here’s the flow:

1. You enter your credentials in the Connect Exchange Account dialog.
2. The backend encrypts them, producing a ciphertext.
3. Only that ciphertext is stored in the database — never the plaintext key or secret.

The in-app hint says it plainly: “Credentials are encrypted and stored securely.”

Who can — and can’t — see your keys

Your plaintext API key and secret are never stored in the database and are not displayed back to you after saving. When editing a connection, the key fields show blank — leave them blank to keep your existing credentials, or re-enter them to replace. Decryption happens only server-side, and only to hand the credentials to the trading engine that talks to your exchange on your behalf.

What connecting actually does

Connecting an exchange establishes a read-only sync of your account. Right after you connect, the terminal pulls in your balances, open positions, and orders so you can see them — but it does not trade for you.

• No auto-trading. The terminal never opens or closes a position on its own.
• Orders are placed only when you place them — via the order form, the chart, or two-click trading.
• Until you deliberately submit an order, the connection is purely informational.

Caution

ZoneX is a manual trading terminal, not a bot. There is no autonomous strategy, copy-trading, or background trading running against your keys. Every order originates from an action you take.

What the terminal can and cannot do with your keys

Capability	Can the terminal do it?
Read balances, positions, and order history	Yes
Place, modify, and cancel orders you initiate	Yes
Open or close positions on its own, without your action	No
Withdraw or transfer funds off the exchange	No — no withdrawal permission, no withdrawal feature
Show you your plaintext API key/secret after saving	No — stored encrypted, never displayed

Account login & email verification

ZoneX accounts are secured through a dedicated third-party identity provider. Your login password is managed by that provider, not stored by ZoneX, and benefits from its standard account-security protections.

Email verification

New accounts must verify their email address before they can use the terminal.

• If your email is not verified, you’re redirected to the Verify Your Email screen and cannot reach the trading terminal or connect exchanges.
• Check your inbox (and spam folder), click the verification link, then log in again.

Account state	What you can do
Email unverified	Only the verification screen — trading, exchange connections, and other app pages are blocked
Email verified	Full access, subject to your subscription and account permissions

Verified once, then log in again

After clicking the verification link, return to ZoneX and log in again so your session picks up the verified status. There’s an “I’ve Verified — Log In Again” button on the verification screen for exactly this.

Security checklist

• Create your exchange API key with Read + Trade only — never Withdrawal.
• Where your exchange supports it, restrict the key by IP allowlist.
• Use a strong, unique password for your ZoneX login.
• Verify your email so your account is fully protected and usable.
• If a key is ever exposed, revoke it on the exchange and reconnect with a fresh one.