Security by Protocol, Not Marketing
We adhere strictly to factual disclosures. StrataRelay does not claim 'bank-grade' or '100% secure'. Instead, we document the precise technical controls and cryptographic guarantees built into the system.
Envelope KMS Credential Encryption
When an exchange connection is established, API keys and secrets are encrypted via AES-256-GCM using an ephemeral Data Encryption Key (DEK). The DEK is itself encrypted by a Master Key Encryption Key (KEK). Plaintext exchange secrets are never persisted in the application database, logs, browser local storage, or repository.
Strict Withdrawal Prohibition
StrataRelay requires restricted API permissions: Trading and Read-Only access only. We never request withdrawal permissions, and our onboarding scanner actively rejects keys that have transfer or withdrawal privileges enabled.
Private Loopback Execution Network
Execution worker processes listen strictly on private loopback interfaces. Under no circumstances are raw execution ports exposed to public networks. Public customer traffic terminates exclusively at the StrataRelay Gateway.
Zero User-Code Execution
Users configure strictly typed quantitative thresholds (stake, stoploss %, leverage, max exposure) validated by schemas. We do not allow custom Python code or uploaded script execution, closing the primary Remote Code Execution (RCE) attack surface.
Active Threat Mitigations Matrix
| Threat Vector | Attacker Motivation | Enforced Architectural Defense | Test Verification |
|---|---|---|---|
| Stolen Exchange Keys | Drain customer funds | No withdrawal permissions allowed; AES-256-GCM envelope KMS; memory zeroization | PASS |
| Multi-Tenant Breakout | Read another user's trades | PostgreSQL Row-Level Security (RLS) + FastAPI token tenant injection | PASS |
| Webhook SSRF Attack | Probe internal cloud VPC | Strict DNS resolution filter; blocks RFC 1918, loopback, link-local, AWS metadata | PASS |
| Webhook Replay / Spoof | Trigger unauthorized orders | HMAC-SHA256 signature + 300s timestamp window + unique event IDs | PASS |
| Session Theft | Hijack account portal | HttpOnly Secure SameSite cookies; short-lived access tokens; step-up auth for keys | PASS |
Non-Custodial Architecture by Default
StrataRelay never holds your funds and strictly refuses withdrawal permissions. Prefer complete self-sovereignty? Consume our institutional signals via our Signal REST API & Webhooks with zero exchange keys connected.