Portfolio access without withdrawal access
Balance and supported history requests use exchange API access intended for reading account data.
Security by design
See your portfolio.Keep account control.
WickSync is built to display account data and support optional user-confirmed actions without taking custody of your funds or requesting withdrawal permission.
Exchange connections
Permissions matched
to the feature.
Portfolio tracking and optional execution are separate capabilities with different permission needs.
Trading access only when enabled
One-click execution requires a trading-enabled connection and an explicit user action. It is not required for portfolio tracking.
Encrypted rather than readable
Stored exchange API credentials are encrypted. Sensitive values are not intentionally exposed in the dashboard or ordinary logs.
Disconnect individual accounts
Users can remove connected exchanges and revoke the API key directly at the exchange.
Wallet sign-in
A signature proves control.
It does not transfer funds.
MetaMask and Phantom can be used for authentication without asking for a seed phrase or a token transfer. Prefer no wallet? A recovery key signs you in without MetaMask or Phantom.
WickSync creates a request that is tied to the intended authentication flow.
The wallet signs the displayed authentication message; it does not sign a withdrawal transaction.
Successful verification creates an application session that can later be ended from the account.
User responsibilities
Security is shared.
Keep the boundaries clear.
Some risks remain outside any portfolio application's control.
Use the minimum permissions
Create API credentials specifically for WickSync and leave withdrawal access disabled.
Protect exchange and email accounts
Use strong unique passwords and multi-factor authentication wherever the exchange or identity provider supports it.
Verify wallet prompts
Read the wallet message and domain before approving. WickSync will not ask for a recovery phrase or private key.
Report security concerns
Email support@wicksync.io. Machine-readable contact details are also published at security.txt.