SECURITY
How Talu Crypt protects your data
Talu Crypt reads your balances. It can never move your funds. Here is exactly what we store, how, and what we refuse.
Never a private key
Wallets are tracked with public addresses and xpubs. We never ask for a private key or a recovery phrase.
Read-only keys, checked
On Binance and Bitfinex, a key that can trade or withdraw is refused before it is saved.
Secrets encrypted
Exchange keys and secrets are encrypted before they are written to our database, and never sent back to your browser.
Two-factor sign-in
Protect your account with an authenticator app, for email and Google sign-in alike.
Blockchain wallets: public addresses only
To follow a wallet, you give Talu Crypt its public address (or an xpub for Bitcoin). A public address lets anyone see a balance; it cannot sign a transaction. Talu Crypt is not a wallet and never holds your crypto: there is no field anywhere in the app for a private key or a seed phrase. If a site or a message ever asks you for one in our name, it is a scam.
Exchange API keys: read-only, verified
To read your exchange balances and orders, Talu Crypt needs an API key. Create it with the read permission only:
- Binance and Bitfinex: when you save a key, our server asks the exchange what the key is allowed to do. If it can trade, withdraw, transfer or use margin, the key is refused and not stored. The check also runs on the server, so it cannot be skipped from the browser.
- Kraken, Kraken Futures and MEXC do not report a key's permissions. The app tells you it could not check: make sure you only ticked the query / read permissions.
- On every exchange, never enable withdrawals on a key you give to any tracker.
- You can delete a connection in the app at any time, and revoke the key on the exchange for good.
What a read-only key can and cannot do
It can read balances, positions and order history. It cannot place an order, move funds between accounts or withdraw. Even in the worst case, a read-only key exposes what you hold, not the funds themselves.
How your data is stored
- Encrypted secrets: exchange API keys and secrets are encrypted (ASP.NET Core Data Protection) before they reach the database. The encryption keys live in a separate folder only the web app's service account can read.
- Never shown again: once saved, a key comes back to your browser masked, showing only its last four characters. The secret is never sent back.
- Separate portfolios: each portfolio is kept in its own database file on the server.
- Hosted in France: the web app and its data run on a server we operate ourselves in France (EU). Every connection is encrypted (HTTPS).
Your account
- Passwords are never stored in plain text: they are hashed with PBKDF2-SHA256 (210,000 iterations), and must be at least 8 characters with upper case, lower case, a digit and a symbol.
- Two-factor authentication: turn it on in your account settings with any authenticator app (Google Authenticator, Authy, 1Password…). It is then asked for with a password and with Google sign-in.
- Brute force: after 5 wrong passwords, the account is locked for 15 minutes.
- Google sign-in: we receive your email address and Google's confirmation that it is verified — never your Google password.
What we cannot promise
No online service is risk-free. Talu Crypt is built and run by one developer, not audited by a security firm. That is why the design limits what could leak: no private keys, read-only exchange keys, encrypted secrets. The privacy policy lists every piece of data we store and who receives it.
Found a problem?
If you think you have found a security issue, write to us before disclosing it, and we will answer quickly: talu@talucrypt.com