Security & Compliance
BiTi is an evidence-driven Bybit USDT-perpetual futures trading operating system. Security is built into the trading core: risk controls, kill switch, circuit breakers, and audit logging are first-class. The controls below describe how credentials, access, and the production environment are protected.
Exchange-key encryption
Exchange API keys are encrypted at rest with AES-256-GCM and are never returned in any API response, log line, or Telegram message. WebSocket/UI clients can never trade — order placement requires the signed server-side path.
Role-based access control
A hierarchical role model (READ_ONLY → USER → TRADER → ADMIN → SUPER_ADMIN) gates every mutating endpoint. Method-level authorization and required-auth are explicit, audited toggles — enabled per the operator runbook after the front-end token round-trip is verified.
Network isolation
The actuator and admin surfaces bind to loopback only; there is no public mutation endpoint. CORS is restricted and webhook callbacks are signature-verified and idempotent.
Audit logging
Logins, settings changes, trading-control toggles, emergency-stop changes, billing/subscription events, and account transfers are written to an append-only audit log with correlation IDs.
Append-only migrations
Database schema changes are append-only Flyway migrations — never edited or deleted — and every safety-critical setting is verified intact on each deploy.
Secret hygiene
No secrets, API keys, or fee literals are committed to the repository or printed to logs. Credentials are supplied as environment variables and redacted from every response.
Risk & no-guarantee disclosure
Trading cryptocurrency derivatives is risky and can result in the loss of your capital. BiTi does not guarantee profit and makes no “always win” claim. Live execution is gated by an evidence chain (expected value after fees, spread, slippage, funding, and execution risk) plus risk gates; first live activation of any strategy remains an operator-owned decision. A subscription or payment grants product feature access only — it never enables live trading, bypasses a risk gate, or forces a trade. See our full risk disclosure.