How we protect your account, your data, and your API connections.
Security is foundational to how XeroAI is built. Because our platform connects directly to your broker and exchange accounts, we hold ourselves to a high standard of protection at every layer.
All connections between XeroAI and supported brokers or exchanges use encrypted, permissioned API keys. Keys are scoped to trading and read-only account access — they never include withdrawal permissions, and we never ask for or store your broker account password.
Data is encrypted in transit using TLS and encrypted at rest within our infrastructure. Sensitive credentials, including API keys, are stored using industry-standard encryption and access controls.
Production systems are hosted on reputable cloud infrastructure with restricted, logged, and role-based access. Internal access to customer data is limited to what is necessary to operate and support the Service.
XeroAI never takes custody of your funds. Your capital remains in your own broker or exchange account at all times, and every automated trade operates strictly within the risk limits you configure.
We recommend using a strong, unique password for your XeroAI account and enabling any available two-factor authentication. You can review and revoke connected API keys at any time from your dashboard.
If you believe you've discovered a security vulnerability in our platform, please report it responsibly to security@xeroai.io. We investigate all credible reports and ask that you avoid publicly disclosing an issue until we've had the opportunity to address it.
Our systems are continuously monitored for unusual activity, and automation is designed to pause automatically if configured risk limits are breached, adding an additional layer of protection for your account.