Security and custody model
Spreadr handles two sensitive things: users' funds (indirectly, via the ability to place trades) and users' signing credentials. This section describes the design honestly, including its limits.
Non-custodial by design
Spreadr never holds user funds. Trades execute against the user's own accounts on each exchange, using credentials the user provisions. Spreadr can place trades with those credentials; it cannot withdraw funds. Where a venue supports scoped API keys, users are directed to issue trade-only credentials, so the key given to Spreadr cannot move funds off the exchange even in principle.
Client-side credential encryption
Signing credentials are encrypted in the user's browser before they are transmitted to Spreadr's control plane. The encryption key is derived on the client — either from a user passphrase (PBKDF2-SHA256, AES-256-GCM) or from a wallet EIP-712 signature (HKDF-SHA256, AES-256-GCM) — and the control plane stores only the resulting ciphertext blob. Credential-handling operations run in a dedicated Web Worker so that plaintext key material is isolated from the main page context.
What the trust model does and does not guarantee
To place orders on the user's behalf, an execution worker must be able to use the signing credential at trade time. Spreadr therefore does not claim that credentials are mathematically unreadable by the running system; it claims, and is designed to ensure, that:
- credentials are encrypted end-to-end from the browser and are never written to the control plane in plaintext;
- at execution time credentials are used only within the isolated per-trade worker, and are never logged or persisted in plaintext;
- the per-trade isolation model contains the blast radius of any single compromised trade;
- users can, and should, scope their exchange API keys to trade-only.
The client-side vault has undergone code-level security review; findings and their resolutions are tracked internally, and the current architecture (Web-Worker-scoped keys, encrypted-at-rest client storage, hardened key derivation) reflects that review.
What Spreadr will not do
- Take custody. Spreadr never holds or can withdraw user funds.
- Trade its own book against users. Spreadr does not run a proprietary trading book and does not trade against user flow.
- Deduct fees from user funds. Spreadr takes no wallet-level fee; its economics come from exchange-side builder fees (Fee model).