Wallet security and secrets
Keep private keys, wallet data, and support screenshots safe.
Wallet security is part of every Dexfy workflow. Treat private keys, seed phrases, recovery flows, and wallet addresses carefully.
Dexfy uses a server-authorized custody model so configured automation can sign without an open browser session. Supabase owns account authentication and MFA; Privy manages wallet signing material and policy-controlled remote signing. Plaintext wallet secrets are not stored in Supabase or Fly runtime configuration.
The engine can sign only through the environment-specific EVM or Solana policy. Exporting a private key is a separate owner-authorized action that requires a fresh Supabase session and can require MFA step-up. This is not the same security model as a non-custodial browser wallet, so keep trading-wallet balances scoped to the strategy.
Never expose
- Private keys
- Seed phrases
- Secret recovery material
- Auth tokens
- Full sensitive screenshots
- Large balance screenshots when not necessary
Support screenshot rules
When support asks for a screenshot, crop it to the issue. Do not include private keys, seed phrases, or unrelated wallet balances.
Operating rules
- Use separate wallets for separate strategies.
- Keep long-term holdings away from high-frequency automation wallets.
- Revoke or rotate access when a wallet strategy changes.
- Contact support immediately if you think an account or wallet was exposed.
- Enable authenticator-app MFA before funding a wallet with meaningful value.