Wallet and Security FAQ

Answers to the most common questions about wallet custody, key management, account safety, and what Alphio can and cannot do with your funds. For more detail, see Wallet Basics, Export Private Key and Security Incidents.

---

Is my wallet custodial or non-custodial? It depends on the account:

• Your Alphio wallet (Perps, Predictions, Tokens) — non-custodial. It's an embedded wallet secured by Privy. The private key is held in Privy's secure infrastructure, and only you can export it. Alphio never sees your private key and never holds your funds.
• Brokerage accounts (Robinhood, or a broker connected via SnapTrade) — your shares and cash are custodied by the broker. Alphio never holds them.

Non-custodial doesn't mean Alphio can never act on your wallet. Alphio can act only through permissions you grant, each limited in scope:

• a Hyperliquid trading agent that can trade but not withdraw;
• Connect Polymarket, which lets Alphio sign Polymarket trades, and carry out withdrawals you confirm with an email code, under a restricted policy;
• Fast trading for tokens, which you turn on yourself, letting trades (including your Agent Warrior's) go through without a wallet confirmation within per-trade and per-period limits;
• automatic deposits into Hyperliquid.

See Wallet & Trade Security.

How do I export my private key? Go to Profile → Account → Wallet → Cash details → Export private key. You can export your EVM wallet (Perps & Predictions) and your Solana wallet (Tokens).

The export needs a 6-digit code emailed to your account plus a code from your authenticator app. If you haven't set one up, the flow sets it up first. The key is then shown in Privy's own secure window. On the mobile app, the export opens the web app to finish there.

External wallets (MetaMask etc.) keep their keys in the wallet app itself, so there's nothing for Alphio to export. See Export Private Key.

Two-factor authentication setup. Alphio uses an authenticator app (TOTP) to protect sensitive actions: withdrawals, exporting private keys and adding withdrawal addresses. It isn't used when you sign in.

To set it up:

1. Open Setting from your avatar menu on desktop web, Account & Security on mobile web, or your account settings in the mobile app. Find Authenticator app and choose Set up.
2. Scan the QR code with Google Authenticator, Microsoft Authenticator, Authy, 1Password or any other authenticator app.
3. Enter the 6-digit code from the app to confirm.
4. Save the recovery codes Alphio shows you. Each one works once in place of an authenticator code.

If you lose your authenticator device and have no recovery codes left, account recovery takes several days. Keep the recovery codes somewhere safe.

I think my account was compromised. Act immediately, in this order:

1. Move funds first if a wallet key may be exposed. Nothing done inside Alphio can reverse an on-chain transfer.
2. Reset your password with Forgot password on the sign-in screen. If you sign in with Google or Apple, secure that account directly.
3. Sign in again on web and on the app. Alphio keeps one active session per platform, so signing in again ends any other session there.
4. Disconnect connected brokers so no further orders can be placed.
5. Contact contact@alphio.ai with the time of the suspected compromise, the IP or device if known, and any suspicious actions you saw.

Support can't freeze your account, reverse a transaction, or recover transferred funds. Full checklist: Security Incidents.

What does Alphio see in my connected broker?

Visible to Alphio	Not visible
Current positions	Broker login credentials
Account balances	Linked bank accounts
Trade history	Tax documents
Order status	Personal details beyond what the broker connection exposes

The connection also includes trading access, which Alphio uses only to place orders you confirm or orders from automations you set up. It can't move cash in or out of your brokerage account.

Can Alphio move funds without my approval? Alphio doesn't withdraw or transfer your money on its own. Withdrawals only happen when you start them and pass verification. Trades happen in one of these ways:

• Manual — you confirm each order on that venue's order form: the stock trade dialog for broker orders, the trade panel on Hyperliquid pages, the order ticket on Polymarket event pages.
• Auto Trade / copy trading — orders follow a rule or a trader you chose, and you can stop it at any time.
• Agentic Trading — orders pass through an approval gate that you respond to per order or per plan.
• Fast trading and Agent Warrior — token trades within your fast-trading limits go through without a wallet confirmation, and an Agent Warrior you start trades on its own until you pause or stop it.

Automatic deposits into Hyperliquid move USDC you sent to your wallet into your own Perps account. The money stays yours.