Security Centre
Sessions, authority and the controls that protect your funds.
Control model
- Your wallet
- Intelo never asks for your wallet's key or seed phrase, and signing in grants no trading authority. Your wallet moves funds only when you sign a transaction yourself.
- Agent wallets
- Every agent trades from its own wallet, funded by you. A hosted 24/7 agent's key is generated and kept encrypted by Intelo's agent host and is never returned by any API; the browser agent's key is encrypted in your browser; a self-hosted agent's key stays on your server. Withdrawals go only to the wallet that created the agent.
- Sign-in
- Sign-In with Ethereum (EIP-4361) with server-side nonce, 15-minute access tokens and rotating refresh tokens. Reuse of a rotated refresh token revokes every session.
- Mandate
- Widening a Mandate requires a fresh EIP-712 wallet signature; narrowing applies immediately. Its emergency stop turns off the autopilot of every hosted agent you run and refuses new buys until you resume with a signature.
- Agent checks
- Before every buy the agent simulates the buy and the sell from its own address (honeypot and hidden-tax checks) and checks holders, owner powers, proxies, liquidity and the LP lock. Missing data blocks the buy. Limits per trade, at risk and per day are enforced by the agent itself.
- AI
- The AI Agent advises only: it can veto a buy, never cause one. It holds no key, signs nothing and executes nothing.
- Staff
- Support and admin roles can pause every hosted agent's autopilot with the platform kill switch. No role can read a key, sign, sell, withdraw or change your Mandate or limits; every staff request is audited.