Security is one of those topics that's easy to gesture at in broad, reassuring terms and harder to explain concretely without either oversimplifying or drowning the point in jargon. Here's the specific, unglamorous version of what we actually do, and what we'd ask you to do on your side.
On our side: structural constraints, not just policy
API keys are stored encrypted at rest, access to them is logged and monitored, and trade-only permissions are enforced structurally rather than just by internal policy — there is no interface anywhere in our system that accepts or processes a withdrawal-enabled key, which means this isn't a rule that could be quietly bypassed under pressure or by mistake. It's a constraint built into what the software is capable of accepting in the first place. Account data more broadly is handled under the practices described in our Privacy Policy, including encryption and access controls around personal information beyond just API credentials.
On your side: the basics that actually matter
Two-factor authentication on both your exchange account and your ZeroLoss account is the single highest-value security step available to you, and it takes minutes to set up. Beyond that: a unique password for your exchange account that you don't reuse anywhere else, since password reuse is one of the most common ways unrelated accounts get compromised through no fault of the platform itself. And periodic review of which API keys are currently active on your exchange account — most people generate a key once and never look at that list again, which means old, forgotten keys with unclear permissions can sit active indefinitely.
The habit that matters most, and the one people skip
Check your exchange's own API permissions page occasionally — not because we expect anything to have changed unexpectedly, but because it's the one source of truth no platform, including ZeroLoss, can override or misrepresent to you. If the withdrawal toggle is ever on for a key you don't recognize the purpose of, disable it immediately and investigate before doing anything else. This single habit closes off more realistic attack surface than almost any other individual action available to you.
What we don't ask for, ever
We will never ask for your exchange account password, your two-factor authentication codes, or a withdrawal-enabled API key, under any circumstance, including what might be presented as an urgent account issue. Legitimate support interactions never require any of these. If a message claiming to be from ZeroLoss asks for any of them, it isn't actually from ZeroLoss, regardless of how convincing it looks — treat it as a phishing attempt and report it rather than responding.
Why we're this specific about it publicly
Vague security messaging — "bank-level encryption," "military-grade security" — is common in this industry and largely unfalsifiable, which makes it not particularly useful to you as a user trying to assess actual risk. We'd rather describe the specific, checkable mechanisms in place: what permission scope is structurally accepted, what you can verify directly on your own exchange account, and what a legitimate request from us does and doesn't look like. That's a higher bar for us to hold ourselves to publicly, and it's also the version of "trust us" that doesn't actually require you to trust us — it requires you to check.
Where to go deeper
Our Non-custodial Disclaimer covers the structural side of this in full legal detail, and our FAQ has specific answers to common account-security questions, including what to do if you suspect unauthorized access.