Skip to content
// non-custodial

Security by design

Your keys are encrypted. Your money stays yours. Kairos only executes — it never custodies.

Your keys

  • API keys encrypted with AWS KMS before storage
  • Never stored in plaintext, never logged
  • Decryption happens only inside the agent process
  • Each user's keys use a unique data key

Your money

  • Alpaca Broker API — trade access only
  • No withdrawal, no transfer, no ACH access
  • We cannot move funds out of your account
  • Paper-trading mode for full isolation

Your data

  • Trade records and reasoning stored per agent
  • Keys stored only as KMS ciphertext
  • No sale or sharing of trading data
  • Soft-delete preserves your history

// infrastructure

How it's built

Compute

AWS / Docker containers, VPC-isolated

Secrets

AWS KMS envelope encryption per key

Storage

PostgreSQL (RDS), encrypted at rest

Found a vulnerability?

We welcome responsible disclosure. Reach the security team at [email protected].

Start free →