Security & Privacy

Security is fundamental to a platform where users trust us with their wallet authorizations and trade execution. This document covers what we do to protect you, what you can do to protect yourself, and how we handle data.

What We Protect Against

We've built defenses for all of these.

Wallet Security

Never custody your funds. Your USDC stays in your wallet. Predite signs trades on your behalf only when you explicitly confirm. We cannot move your funds without your active permission.

Encrypted key storage. To trade on Polymarket's CLOB, Predite holds the private key of the wallet you connect — there is no browser pop-up flow, because the CLOB is an API and orders are signed server-side. The key arrives over HTTPS, is encrypted with AES-256-GCM (scrypt-derived key, a fresh random IV per record), and only the ciphertext is stored. It is decrypted in memory for the instant an order is signed, and never written to logs. Be clear-eyed: this is custody of a hot trading key. The mitigation that actually protects you is funding a dedicated wallet with only your trading bankroll.

On-chain approvals are unlimited — and Predite sets them, not you. Before your first order the wallet must approve Polymarket's contracts, and those approvals are sent for you as an UNLIMITED approval, plus a blanket approval on the outcome tokens. That is how polymarket.com works too, but it means the allowance is not your exposure control. What actually bounds your exposure: the per-order and daily caps, the per-bot limits, your kill switch, and the size of the dedicated wallet you funded.

Revocable. You can revoke our access anytime via your wallet's token approval settings on Polygonscan.

Account Security

Authentication via Clerk. We don't manage passwords ourselves — Clerk does. They specialize in auth and follow industry best practices (bcrypt password hashing, rate limiting, breach detection).

Bot plan + per-account beta flag. Live trading is gated twice: an active Bot subscription and a per-account beta flag that only support can set. Neither the API nor the UI can bypass it.

Session management. Sessions expire automatically. You can review and revoke active sessions anytime in your profile.

Email verification. Email changes require verification of the new address before taking effect.

Application Security

HTTPS everywhere. TLS 1.3 for all connections. No HTTP fallback.

Content Security Policy. Strict CSP headers prevent script injection.

Rate limiting. Aggressive rate limits prevent brute force attacks, API abuse, and DDoS attempts.

CSRF protection. Every state-changing action requires a fresh CSRF token. Prevents cross-site request forgery.

SQL injection prevention. Parameterized queries everywhere. No string concatenation in database operations.

XSS prevention. User input sanitized at every render boundary. React's auto-escaping helps but we don't rely on it alone.

Database Security

Encryption at rest. Supabase encrypts all data on disk.

Row-level security. Each user only sees their own data — enforced at the database level, not application level. Even if our app code had a bug, the database refuses unauthorized queries.

Audit logging. Every sensitive action (trade, withdrawal, password change, MFA toggle) logged with timestamp and IP.

Backup procedures. Daily encrypted backups with 90-day retention. Point-in-time recovery available.

Network Security

Cloudflare DDoS protection. Our edge layer absorbs traffic attacks.

Vercel infrastructure. Production traffic flows through Vercel's hardened network.

No direct database access. Our database isn't reachable from the public internet. Only our application can connect.

API rate limits. Per-user and per-IP limits prevent abuse and scraping.

What Users Can Do

Strong password + MFA: a unique password generated by a password manager, plus authenticator app MFA. Stops 99% of attacks.

Hardware wallet: for serious capital (>$1k), use Ledger or Trezor. Even if our systems are compromised, the wallet refuses unauthorized signatures.

Verify URLs: bookmark predite.io directly. Phishing sites can look identical to real ones — never click sign-in links from emails.

Limit approvals: set USDC spending caps low. Re-approve when needed. Limits exposure of any single security incident.

Be skeptical: legitimate support won't ask for seed phrases, passwords, or 2FA codes. Anyone asking is a scammer.

What Happens If We're Breached

We have a documented incident response process:

1. Detect: monitoring alerts our team within minutes of anomaly
2. Contain: rotate keys, revoke sessions, halt suspicious activity
3. Investigate: full forensic analysis with timeline
4. Notify: affected users notified within 72 hours (GDPR requirement)
5. Remediate: patch the vulnerability, document the lesson, share publicly
6. Recover: restore from backups if needed

We've never had a breach. But if we ever do, transparency comes before convenience.

Compliance

Privacy

We never sell user data. Period.

Reporting Security Issues

Bug bounty program in planning. Currently informal — significant findings get acknowledgment, credit, and account credits/swag.

Independent Security Review

We currently disclose security claims honestly — we say "SOC2-ready architecture" not "SOC2 certified" because we haven't completed the audit yet. Many platforms make claims that are misleading; we don't.

Related Docs