Introduction
The Non-Custodial Model
The core invariant of Aegis — trade-only keys, user-signed DEX transactions, and secrets the API never returns.
The invariant
Aegis is non-custodial by design: Aegis never holds your funds. This is not a policy you have to trust — it is enforced by the platform's rules.
- CEX keys are trade-only. An exchange API key is rejected unless withdrawals are disabled. Aegis can place and manage orders, but it can never move funds off your exchange account.
- You sign every DEX transaction. On a DEX, every transaction is signed by your own wallet. Aegis never signs on your behalf and never holds funds.
- Secrets stay secret. Exchange API keys are envelope-encrypted with a KMS (AWS KMS). The API never returns your secret — not to the dashboard, not to you, not to anyone.
Because the trade-only rule caps the blast radius, even a worst-case compromise cannot withdraw your assets.
What Aegis can and cannot do
| Aegis can | Aegis cannot |
|---|---|
| Read your balances and positions | Withdraw or transfer your funds |
| Place MARKET, LIMIT, STOP_MARKET, STOP_LIMIT orders | Sign a DEX transaction for you |
| Run strategies and enforce risk limits | Bypass the trade-only key restriction |
| Halt trading with the kill switch | Return your API secret through the API |
| Record every action in the immutable audit trail | Hold or take custody of your assets |
Defense in depth
The non-custodial guarantee is backed by layered controls: KMS envelope encryption for keys, multi-tenant isolation with PostgreSQL Row-Level Security, a double-entry append-only ledger, an immutable audit trail with a transactional outbox, and a deterministic risk engine.
For how this fits the wider system, see Architecture; for the step-by-step onboarding, see How Aegis Works.