Security

Signal Bench connects to your exchange account to place trades for you. That is a serious thing to be trusted with, so this page says exactly what we do to protect it, and what we do not do. Nothing here is a guarantee against loss from trading; see the risk disclosure for that.

Your money never passes through us

• Non-custodial. Your funds stay on your exchange. Signal Bench never holds, receives or moves customer funds, and has no wallet or balance of yours.
• Trade-only API keys. When you connect an exchange we check the key's permissions. A key that can withdraw is refused outright; the bot runs only on keys that can trade and nothing more.
• Keys are encrypted at rest. API keys and secrets are stored encrypted (Fernet: AES with an authentication tag) under a server-side key, never in plain text, and are masked everywhere they are displayed or logged.
• Payments go straight to the provider. Crypto payments are sent to the platform wallet on-chain and verified from the chain. Card payments happen on the payment provider's own page; card numbers never reach Signal Bench.

Your account

• Passwords are stored as bcrypt hashes, never in a recoverable form.
• Two-factor login with any authenticator app is available in the dashboard under Settings. With it on, a password alone opens nothing. Eight one-time recovery codes are issued once and stored hashed. Turning it off requires a current code or a recovery code, so a stolen session cannot remove it.
• Session revocation. Changing your password signs out every other device at once; tokens from before the change stop working.
• Login protection. Repeated failed logins back off per account and per address, and the two-factor step is limited the same way, so guessing is not a workable attack.

How the bot limits damage

• A stop-loss on the exchange with every entry. A live position is not treated as open until an exchange-native protective stop is confirmed resting. If that confirmation fails, the position is closed rather than left unprotected.
• Liquidation kept away from the stop. Leverage is capped so that the exchange's liquidation price sits at least two stop-distances beyond the entry, on top of a platform-wide leverage ceiling.
• Hard risk limits you set. Risk per trade, margin per trade, open positions, trades per day and a daily loss stop are enforced server-side on every entry, and a losing streak pauses new entries.
• Deny by default for real money. Live trading needs the operator's lock to be on, a paid plan and explicit per-account approval. Trials and free accounts run the bot on paper only, and can never reach a real order.
• Separate paper, testnet and live records. Results are never blended, and every published signal is logged before its outcome and shown with its loss or win.

What we do not do

• We do not ask for, store or accept withdrawal-enabled keys.
• We do not store card numbers, CVCs or bank details.
• We do not sell or share account, key or trading data with third parties.
• We do not promise profits. The public track record exists so you can check our claims.

Reporting a problem

If you believe you have found a security issue, email support@indigogames.pk with the details. Please do not test against other people's accounts. We read every report and will tell you what we found.