> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trady.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> What Trady does on its side, and what you need to do on yours. Non-custodial architecture, scoped signing, and the scams that actually drain traders.

Paranoia is a survival trait in the trenches. Here's what Trady does on its side, and what you need to do on yours.

## What Trady does

* **Non-custodial by architecture.** Wallet keys are managed by [Privy](https://privy.io) — the same embedded-wallet infrastructure used across major consumer crypto apps. Keys are sharded and reassembled only during signing in secure hardware. Trady never sees or stores your full key. Details: [Custody, Key Export & Import](/account-wallets/custody-key-export-import).
* **Independent security audit.** Trady's infrastructure is undergoing an audit by [Hexens](https://hexens.io), a security firm that has audited major protocols. {/* TODO(team): link the report when published */}
* **Lean pipeline.** The fewer parties that see your transaction before it lands, the smaller the attack surface — Trady's execution path is built on that principle. See [Transaction Lifecycle](/trading/transaction-lifecycle).
* **Scoped signing permissions.** Trading operations are authorized through session-scoped keys — approving a trade doesn't hand the app a blank check. {/* TODO(team): confirm session-key wording matches product */}
* **No God mode.** After the industry learned the hard way what happens when employees can look up user positions: internal access to user data is restricted and logged. {/* TODO(team): confirm this claim precisely before publishing */}

## What you do

The most common way traders lose funds is not a protocol hack — it's signing the wrong thing on the wrong site.

1. **Bookmark [the official links](/start-here/official-links).** Type URLs, don't click them from DMs or search-ad results.
2. **Nobody legit DMs first.** "Trady support" sliding into your DMs = scammer. Every time.
3. **Your seed phrase / private key is for you only.** Not for "verification", not for "wallet sync", not for support. Anyone asking = thief.
4. **Separate trading from browsing.** Keep your Trady trading wallet off external mint/claim/airdrop sites. Use a burner wallet with pocket change for that. See [Wallets](/account-wallets/wallets).
5. **Check what you sign.** A "claim" that asks for token approvals or a `setAuthority` signature is a drainer.
6. **Fake tokens land in wallets constantly.** A random token appearing in your wallet is spam — don't interact with it, don't visit the URL in its name. Just hide it.

## Reporting a vulnerability

Found a security issue in Trady? Report it privately via the [support bot](https://t.me/tradysupportbot) — do not post it publicly.

## Mini-FAQ

**Is there 2FA?**
Your sign-in method (email code / social OAuth) gates account access; signing keys never leave secure infrastructure. {/* TODO(team): confirm additional 2FA options if any */}

**What happens if Trady gets hacked?**
Funds sit in non-custodial wallets whose keys Trady doesn't hold — the worst-case blast radius is fundamentally different from a CEX. Export your keys and you hold the ultimate fallback.

**What if I get drained?**
Blockchain transactions are irreversible — no one, including Trady, can claw funds back. Report it to [support](/troubleshooting/contact-support) so we can flag addresses, and rotate to fresh wallets immediately.