Security & custody
You keep custody. Always.
You're trusting a DCA bot with access to your exchange account, so you deserve to know exactly how it's built. The short version: trade-only keys, no custody, encrypted at rest, open source. Keep withdrawal permission disabled on the bot's key. Use your exchange for withdrawals.
Trade-only keys — the bot can't move your Bitcoin
Use only the read and trading permissions required for your exchange. Keep withdrawal permission disabled. Unauthorized trading can still cause losses if a key is compromised.
No custody — your keys, your funds
We never hold your Bitcoin or your AED. The bot is software that acts on your own exchange account. If we disappeared tomorrow, your funds are exactly where they were — on your exchange, under your control.
Keys encrypted at rest (Fernet)
Your exchange API keys are stored encrypted with Fernet (AES-128-CBC + HMAC), decrypted only in memory at trade time. Raw keys and secrets are never written to logs.
IP-whitelisting
Lock your API key to the bot's outbound IP at the exchange, so the key is useless from anywhere else — shown to you in the dashboard when you connect an exchange.
Withdraw through your exchange
Dashboard withdrawals are unavailable. Use the exchange’s own interface when you choose to move funds. Check the destination, network, charges and any address-verification requirements.
Open source — audit it yourself
MIT-licensed and public on GitHub. Read every line and run it yourself — every feature is free. No black box.
The one thing to understand: trade-only keys
Exchange API keys come with scopes. A trade-only key lets software place orders but not withdraw funds. That's the only scope the bot needs to dollar-cost-average for you. A compromised trading key can cause losses through unauthorized orders. Dashboard withdrawals are unavailable; do not add withdrawal permission to the bot's key.
Manage withdrawals in your exchange's own interface and review its current security controls, fees and recipient requirements.
Honest about risk
No software is risk-free, and we won't pretend otherwise. Bitcoin itself is volatile; exchanges can have outages; you are responsible for your own account security (use a strong exchange password and 2FA). What we control, we've built to fail safe — and because the code is open source, you don't have to take our word for any of it.
Holding a meaningful stack? Go further than a single hardware wallet — our UAE multisig guide walks through removing every single point of failure from your custody.
Stack with confidence
Trade-only keys, no custody, your wallet. The DCA bot automates AED → BTC across your exchanges using your exchange account. Dashboard withdrawals are unavailable; use the exchange's own interface to move funds. Free and open source; you run it yourself.
See the DCA bot →