Security and Privacy | DeFi Orbit How DeFi Orbit protects your data: read-only access, no custody of keys or funds, encryption and responsible disclosure. Canonical: https://defiorbit.xyz/legal/security --- Legal # Security & Privacy Last updated October 13, 2026 DeFi Orbit is built to be read-only. We never ask for private keys or seed phrases, and none of our products can move funds. This page explains how we classify and protect the data we do hold, who can access it, and how we respond when something goes wrong. ## 01Read-only by design Every DeFi Orbit product reads public blockchain data. None of them can sign or submit a transaction. - We never request private keys, seed phrases or transaction approvals - You can track any address without connecting a wallet. To prove you own a wallet, you sign a short text message, which cannot move funds or approve anything - Every API endpoint and every DeFi Orbit AI tool returns data only: none can move funds - Your assets stay under your control at all times ## 02Data we hold and how we classify it We sort the data in our care by how much harm its disclosure could cause, and handle each class accordingly. ### 2.1Restricted Account credentials, API key secrets, billing details, referral payout details and Portfolio Enterprise client records. Access is limited to named staff who need it, and the data is encrypted in transit and at rest. ### 2.2Confidential Account information, the wallet addresses you track, alert settings including Telegram chat IDs, usage and request logs, and support conversations. Access is limited to staff with a business need. ### 2.3Internal Operational data such as system metrics and internal documentation. Not shared outside the company. ### 2.4Public On-chain data, published documentation and marketing content. Protected against unauthorised changes, but free to disclose. ## 03Encryption We use encryption for: - Data in transit, over TLS - Sensitive data at rest, including API key secrets and billing data - Communication between our internal services - User authentication ## 04Access control ### 4.1Least privilege Staff get access to systems and data only as their role requires, through individual accounts tied to each person. ### 4.2Authentication Multi-factor authentication is required for production systems, cloud consoles and admin tools. ### 4.3Reviews and offboarding Access rights are reviewed regularly and removed promptly when someone changes role or leaves. ### 4.4Your API keys You control your own keys: create separate keys per environment, review usage and request logs, and revoke a key at any time from the API Platform. Rate limits apply to every key. ### 4.5Your team and clients In Portfolio Enterprise, each client sits in its own sub-account and sees only the wallets you assign. Share links can be turned off at any time, and access for your team follows the seats and settings on your account. ## 05Infrastructure and application security - Production runs on managed cloud infrastructure with network-level access controls - Systems and dependencies are patched on a regular schedule - Code changes are reviewed before they reach production - Secrets are kept in a managed secrets store, never in source code - Rate limiting and abuse detection protect the API and the app - Traffic and logs are monitored for unusual activity ## 06DeFi Orbit AI DeFi Orbit AI is our hosted MCP server. It uses the same API keys, rate limits and logging as the API, and all of its tools are read-only. - Data is returned only to the assistant that made the request - The server never holds wallet keys, so an agent has nothing to act with - Once data reaches your assistant, its model provider’s terms apply, so choose a client whose data terms you are comfortable with ## 07Third-party providers We use a small number of vetted providers to run the service, each limited to the data it needs: - Payment processing. We do not store full card numbers - Email delivery, and Telegram for alerts you turn on - Cloud hosting and storage - Blockchain nodes and market data providers, which receive public on-chain queries only ## 08Availability and backups Live status and incident history are published at status.defiorbit.xyz. Customer data is backed up regularly, and restores are tested. Uptime commitments apply only where agreed in a signed order form. ## 09Incident response If we detect or are told about a security incident, we: - Contain it and assess what was affected - Investigate and document the cause - Notify affected customers and regulators without undue delay, as required by law, with what happened and what we are doing about it - Fix the cause and update our controls to prevent it happening again ## 10Responsible disclosure If you believe you have found a vulnerability in DeFi Orbit, email security@defiorbit.xyz with the steps to reproduce it. We acknowledge every report and keep you updated until it is resolved. When testing, please: - Give us reasonable time to fix the issue before disclosing it publicly - Use only your own accounts and API keys - Not access, change or delete other users’ data - Not run denial-of-service attacks or social-engineer our team We will not take legal action against researchers who follow these rules in good faith. ## 11Your privacy How we collect, use, share and retain personal information, and your rights over it, are set out in our Privacy Policy. ## 12Reviews and updates We review these practices regularly and update this page when they change. The date at the top shows the latest revision. Found a vulnerability or have a security question? Email security@defiorbit.xyz. We review every report and reply to the sender. Security questions? Email [security@defiorbit.xyz](mailto:security@defiorbit.xyz) or use the [contact page](/contact-us). × Book a demo ## See how DeFi Orbit fits your stack Thirty minutes with the team. Bring a wallet address and the report you wish you had. - A walkthrough using your positions, not sample data - Which product fits: Portfolio, the API or both - Pricing for your wallets, clients and volume Just want to try it? [Get an API key](https://platform.defiorbit.xyz) or[launch the app](https://app.defiorbit.xyz). 1. 1 · Your details 2. 2 · Pick a time ## Pick a time, there 30 minutes · Video call · Your details are filled in for you ← Edit details[Open the calendar in a new tab ↗](#)