What Xhyzer cannot do
Last reviewed 27 July 2026
Connecting exchange keys to someone else's software deserves suspicion. This page describes what the service is architecturally incapable of, what it stores, and how you can check each claim yourself rather than take our word for it.
It cannot trade, and it cannot withdraw
Not as a policy, as a property. Xhyzer never holds a credential capable of moving your money, on any venue. What each connection actually requires:
| Venue | What we hold | Why it cannot trade |
|---|---|---|
| Hyperliquid | Your public wallet address | No key of any kind exists. Positions are read from public chain data, so there is nothing to steal and nothing to revoke. |
| Lighter | A read-only token | Issued by Lighter as read-only. It can sign no transaction, so it cannot place an order or move a balance even if it were taken. |
| Extended | A read-only API key | Grants read access to your account only. |
| Ondo Perps | An API key with View only | Ondo issues keys with separate View, Trade and Transfer permissions. Where it will report a key's permissions back to us, a key carrying Trade or Transfer is rejected and never stored. Ondo also permissions that reporting endpoint itself, so a View-only key often cannot read its own scopes: such a key is accepted and shown as unverified rather than described as checked. Create it with Trade and Transfer switched off. |
| Bybit, Binance | An API key and secret | Tested against the exchange's own permissions API before anything is written to disk. A key that can trade or withdraw is rejected and never stored. |
Check it yourself
Two ways, neither requiring you to trust this page.
Try to give us a dangerous key. Create a Bybit or Binance key with trading enabled and save it in Settings. It is refused, with the reason, and nothing is stored. That check runs on every save, for every account.
Revoke at the source, any time. Delete the key at the exchange and the desk simply stops updating. Your access to your money never depended on us, and nothing we hold survives your revocation.
What we store, and how it is protected
Exchange credentials are encrypted before they touch the database, using Fernet (AES-128-CBC with HMAC authentication). The key lives in the server environment, never in the database, so a copy of the database file alone will not decrypt them.
Passwords are hashed with scrypt using a unique random salt per account and compared in constant time. We cannot read your password, and neither can anyone who takes the database.
Sessions use a cryptographically signed cookie, marked HttpOnly and SameSite=Lax and sent only over HTTPS in production.
Every query is scoped to your account. There is no route that returns another user's data, and no path by which one signed-in user can write to another's account. A read-only guest you invite can see the desk you shared and nothing else.
Credentials are never written to logs. That is enforced by an automated test, and by a check that fails our build if any code outside the small set of configuration modules reads a secret at all.
Servers and data are in the European Union (Frankfurt).
What we never load
No third-party scripts, stylesheets or fonts. No analytics provider, no tag manager, no session recorder, no advertising pixel, no external CDN. Nothing about your account is sent to another company, because nothing from another company runs on these pages.
Verify it in about five seconds: open your browser's developer tools, switch to the Network tab, and reload any page of the app. Every request goes to this domain. Our build fails if an external asset is ever added.
Visitor counts are measured first-party and without cookies. The Cookie Policy explains exactly how.
What we can see
Read-only is a limit on what we can do, not on what we can read. To compute your funding APR we necessarily read your positions, balances, funding payments, fees and trade history. That is the product, and you should weigh it.
That data is never sold, never shared, and never used for advertising. It is not combined across users except as anonymous aggregate counts. You can delete stored credentials at any moment in Settings, and request deletion of your account and history at support@xhyzer.xyz. See the Privacy Policy for the full detail.
Reducing what you expose
If you would rather not point us at your whole book, two things help. Most exchanges let you restrict an API key to specific IP addresses, and we will give you our server's outbound addresses on request. And because the app supports several accounts per exchange, you can connect a single subaccount rather than everything you trade.
Reporting a problem
If you find a vulnerability, write to support@xhyzer.xyz with enough detail to reproduce it. You will get a reply. Please do not run automated scanners against the live service: it is a single small instance and doing so degrades it for people relying on it.
What this page is not
It is not a third-party audit and not a certification. Xhyzer is a small, independently operated service. The statements above are architectural facts you can verify yourself, and that is exactly the weight they should carry, no more.