Security

What FundingArb does and doesn't do with your keys and your funds, and what you should configure on your side.

Architecture

No custody

FundingArb never holds your funds. You keep your exchange accounts; the bot only places orders through your own API keys.

Self-hosted

The bot runs on infrastructure you control (your own VPS or machine) — not a hosted service operated by us.

No telemetry, no phone-home

License validation is fully offline (Ed25519 signature check, since v1.1.0). The bot does not contact any FundingArb server at runtime.

Auditable source

Exchange adapters, configuration, and the full dashboard (backend + frontend) are delivered as readable Python/JS source — inspect everything that touches your API keys before running it.

⚠ The core execution engine (scanner, monitor, strategy, order execution) is delivered as a compiled Python extension to protect the proprietary trading logic. It imports and runs identically to plain source, but is not human-readable. Everything that reads or transmits your API keys — the exchange adapters and configuration layer — is plain, auditable source.

What your exchange API key should (and shouldn't) be able to do

Required: spot trading, futures trading, read account balance/positions.
Not required — do not grant: withdrawal permission. FundingArb never needs to move funds off the exchange, so withdrawal access only adds risk without adding function.
If your exchange supports IP allowlisting for API keys, restrict the key to your VPS's IP address.
Use a dedicated API key for FundingArb — don't reuse a key that's also used by other tools or scripts.

Operational recommendations

Enable 2FA on your exchange account itself (this is independent of the bot and API keys, but it's the most common actual account-compromise vector).
Keep your VPS updated and access-restricted (SSH key auth, no password login, firewall limiting inbound ports to what the dashboard needs).
Start in dry-run mode (the default) before enabling real order execution — this exercises the full logic against live market data with zero funds at risk.
Review the FAQ and Setup Guide for exchange-specific configuration notes before going live.

Reporting a security issue

If you find a vulnerability in the bot, the dashboard, or the delivery process, please report it privately to support@fundingarb.net instead of opening a public issue. We'll acknowledge and address genuine reports — this is a small, self-hosted product, so response time depends on severity, but security reports get priority over feature requests.