Security Architecture
How Vordant Protects Your Account
Exchange API keys stored server-side only. HMAC-validated webhooks. Role-based access controls. An immutable audit log for every action.
Exchange API Key Security
Your exchange API keys are stored server-side only. They are never returned to the browser, never appear in client-side JavaScript, and never transit in URL parameters or cookies. When Vordant needs to route an order to an exchange, it retrieves the key server-side and uses it directly in the outbound API call — the key is invisible to everything in the client environment.
HMAC Webhook Validation
Every incoming webhook signal is authenticated using HMAC signature validation. This ensures that signals are only accepted from your TradingView strategy — spoofed or malformed signals are rejected before they reach any bot logic.
Role-Based Access Control
Admin routes and privileged operations are protected by role-based access control. Non-admin accounts cannot access system configuration, user management, or audit records outside their own account scope.
Immutable Audit Log
Every privileged action in Vordant generates an audit log entry with a timestamp, actor identity, action type, and outcome. The audit log is append-only — entries cannot be modified or deleted. This gives you a complete, reliable record of everything that happened in your account.