Wallet & Trade Security
Alphio is non-custodial. Your on-chain funds sit in your own Alphio wallet, and your stocks sit with your broker, never on Alphio's books. Alphio trades for you only through scoped permissions you grant, and it checks your identity again before sensitive actions.
1. Your Alphio wallet
All on-chain trading runs on your Alphio wallet, an embedded wallet secured by Privy:
| Wallet | Network | Used for |
|---|---|---|
| Perps & Predictions wallet (EVM) | Arbitrum / Polygon | Hyperliquid perps, Polymarket |
| Tokens wallet (Solana) | Solana | Token trading |
- The private key is generated and held inside Privy's secure infrastructure, not on Alphio's servers.
- Alphio never sees or stores your private key.
- External wallets (MetaMask, WalletConnect, etc.) can no longer be added. Ones connected earlier remain read-only · withdraw only.
2. Private key export
You can export the private key of either wallet at any time and use it in another wallet app:
- Export requires a 6-digit code emailed to your account and a code from your authenticator app. If you don't have an authenticator yet, you set one up as part of the export.
- The key is revealed only inside Privy's own secure window.
- On the mobile app, export hands off to the web app.
See Export Private Key.
3. Scoped permissions Alphio uses
Non-custodial doesn't mean Alphio can never act. These are the permissions it can hold on your wallet. Each one is limited in scope and tied to something you turned on:
| Permission | What it allows | What it can't do | How it's granted / revoked |
|---|---|---|---|
| Hyperliquid agent | Place, cancel and close perps orders on your Hyperliquid account | Withdraw or transfer funds off Hyperliquid | Authorized with gas-free signatures when you start trading perps. The authorization expires. Revoked with Disconnect Hyperliquid |
| Polymarket trading | Sign Polymarket trades from your wallet under a restricted policy, and carry out Predictions withdrawals you confirm with an email code | Anything outside that policy | Granted by Connect Polymarket, revoked by Unlink Polymarket once your orders, copy-trading, positions and balance are cleared |
| Fast trading (Tokens) | Sign token trades from your wallet without a wallet confirmation, within per-trade and per-period limits. Your Agent Warrior trades through it | Trades over those limits, or any other kind of transaction | You turn it on in the fast-trading dialog; the permission expires, and you can turn it off there |
| Automatic deposit into Hyperliquid | Move USDC that arrives at your wallet's Arbitrum address into your own Perps account, and approve Alphio's Hyperliquid agent for you | Send funds anywhere else | Set up on your Alphio wallet when you use Perps. Turned off for that wallet when you disconnect Hyperliquid |
The Hyperliquid agent key is generated by Alphio and stored encrypted on Alphio's servers so it can submit your orders.
Disconnecting Hyperliquid stops copy trading on that wallet first. After that, Alphio can't place, cancel or close anything there. Positions you leave open stay on Hyperliquid for you to manage on hyperliquid.xyz.
4. Broker connections
Stock brokerage accounts connect through SnapTrade (Webull, Public, tastytrade, Moomoo, Trading 212, E-Trade, Wealthsimple) or through Robinhood's own Robinhood Agentic flow.
- Trading access is part of the connection. Alphio reads positions, balances and history, and it can place orders.
- Manual orders are confirmed one at a time. You place a broker order from the stock trade dialog, review it, and confirm before anything is sent.
- Automated rails run only on a grant you set up. Auto Trade, copy trading, Agentic Trading, and scheduled or triggered trade tasks you set up in chat can submit broker orders without a per-order confirmation, under a rule or approval gate you configure and can stop at any time.
- No money movement. Alphio can't deposit to or withdraw from your brokerage account.
- No credentials. You sign in on SnapTrade's or Robinhood's own pages. Alphio stores only the resulting authorization.
- Disconnecting removes the connection on Alphio's side. For Robinhood, also disconnect the agent in the Robinhood app (Settings → Agents) to fully revoke access.
5. Verification for sensitive actions
Moving money out or taking control of a key needs a second check beyond being signed in:
| Action | Verification |
|---|---|
| Withdraw from Perps, Tokens or your wallet's Arbitrum USDC | Authenticator app code if set up, otherwise a 6-digit email code |
| Withdraw from Predictions (Polymarket) | 6-digit email code |
| Export a private key | Email code and authenticator app code |
| Delete a wallet | 6-digit email code |
| Add a saved withdrawal address | Authenticator app code. New addresses have a cooling-off period before use |
The authenticator app isn't used for sign-in. Set it up under Setting → Authenticator app (desktop web) or Account & Security (mobile web), and keep your recovery codes safe.
6. Incident response
If you suspect your account, wallet or broker connection is compromised:
- Move funds to a fresh wallet you control if a private key may have leaked.
- Reset your password and sign in again on web and the app, so other sessions end.
- Revoke access: disconnect brokers, disconnect Hyperliquid, and unlink Polymarket. For Robinhood, also disconnect the agent in the Robinhood app.
- Contact support. See Security Incidents for the full checklist and contact path.
7. Insurance / coverage
Alphio does not insure or reimburse trading losses, on-chain transaction mistakes, or compromised wallets and accounts.
Alphio is non-custodial: your funds sit in your own wallet, in your broker account, or on the venue you trade on, never with Alphio. So Alphio has no pool to reimburse from and can't reverse an on-chain transaction once it's signed and broadcast. Anything held at a broker or venue is covered only by that venue's own terms.
The safeguards that protect you are the ones you control:
- keeping your account email and authenticator secure;
- checking an address before you send to it;
- only granting trading permissions you're comfortable with.
This page is available as plain Markdown at https://alphio.ai/docs/technology/wallet-and-trade-security.md. An index of every page, with a one-line summary each, is at https://alphio.ai/docs/llms.txt.