Trust
Security model and limits
Where keys live, what they can do, and the known limits.
Where keys live
| Key | Where | Can it |
|---|---|---|
| Wallet (Rabby, Phantom, Lace…) | Your browser extension; Vektor never sees it | Sign deposits, withdrawals, the connect challenge |
| API wallet (Ed25519) | Browser memory; local storage only if you tick Remember | Trade and cancel. Cannot deposit or withdraw |
| Worker keys | Environment variables on your server | Trade and cancel |
What is stored
Local storage holds grid state (no secrets), whether you finished the walkthrough, and - only if you opt in - the API wallet key pair. Disconnect removes the keys. Nothing is sent to any server of ours; the only server code is a relay that forwards balance queries to public RPC nodes.
Known limits
The browser terminal acts only while the tab is open; use the worker for unattended operation. Backtests are optimistic on thin books. L3 radar thresholds are hand-tuned.