Security
Last updated October 9, 2026Koro reads your trades. It can’t place orders, withdraw or move funds, and we check that on every sync.
Read-only, checked every time
- •We reject any API key that can trade, withdraw or transfer, and check the key’s permissions again on every sync.
- •Hyperliquid and Lighter need only your public wallet address. No key at all.
- •Koro has no way to place an order on your exchange.
Your keys
- •API keys are encrypted (AES-256-GCM) and kept in a store only our sync service can read.
- •A saved key is never shown again and never sent back to your browser.
- •Remove a connection at any time; delete your account and the keys go with it.
Your data
- •Encrypted in transit. Every account’s data is isolated by row-level security in the database.
- •We never sell your data. Payments go through Paddle; we never see or store your card.
- •Who processes what, and how long we keep it: Privacy Policy.
Report a problem
Found a security issue? Email support@korotrade.com with “Security” in the subject. We read every report. No system is perfectly secure; if a breach affects you, we’ll tell you as the law requires.