Trust
Security
Minto holds real funds, so security isn't a later thing. It ships with every feature it protects.
Key custody
- Envelope encryption. Each private key is encrypted with its own random 256-bit data key using AES-256-GCM. That data key is then encrypted by a master key. The database only ever stores ciphertext.
- Isolated signer. One component decrypts keys, and only for a single signing operation. The key is zeroed from memory right after.
- Intent binding. The signer only signs a transaction whose exact bytes match an intent approved by the validator (checked with an HMAC). Anything else is refused.
- Vanity keys stay secret from birth. Grinder keys are encrypted in memory the moment they're found and never written to disk, logs or temp files.
Account security
- Passwords hashed with Argon2id.
- TOTP two-factor authentication.
- Rate limits on login, signup and every money-moving endpoint.
- 2FA locks for 15 minutes after 5 wrong codes.
- Email alerts for logins from new devices and all sensitive actions.
- Session management: see every active session and revoke any of them.
What needs what
| Action | Requires |
|---|---|
| Withdraw to an external wallet | 2FA every time |
| Export a private key | Password within 5 minutes + 2FA + typed wallet label + checkbox. Max 3 per wallet per day |
| Enable Autonomous mode | 2FA |
| Disable 2FA | Password + 2FA |
| Add an allowlisted address | 2FA, then a 24h cooldown |
| Turn allowlist mode off | 2FA |
| Bridge out | 2FA |
| Move funds between your own wallets | Nothing extra (no fee either) |
AI and prompt injection
Token names, descriptions, tweets and websites are untrusted. They go to the AI model as clearly delimited data, never as instructions. Each bot type only gets the tools it needs (Researchers get no trading tools). And the validator is the final authority: even a fully manipulated model can't trade outside your strategy, move funds out or export keys, because those actions simply aren't available to it.
Platform
- Secrets live in environment config, never in the repo.
- Secure, HTTP-only session cookies; same-origin checks on every state-changing API call; clickjacking and sniffing protections.
- An audit log records every money movement and security event.
Custodial means trust
Minto holds your keys so your bots can trade while you sleep. Only keep what you're actively trading here, and export keys whenever you want to take custody back.