Security & privacy
In crypto, security isn't a feature page — it's the product decision everything else depends on. Here is elvaro's model, stated plainly.
Non-custodial by design
elvaro never holds, moves, or has the ability to move your funds. Wallet sign-in is authentication only — a cryptographic proof of ownership, not an access grant. We never ask for seed phrases, private keys, or exchange API keys with withdrawal permissions. There is no elvaro wallet to hack, because there is no elvaro wallet.
Read-and-recommend, never execute
The agent architecture is deliberately scoped: elvaro researches, monitors, and recommends. It does not place orders, sign transactions, or move assets — for anyone, under any instruction. This is enforced at the system level, not by policy: the execution capability does not exist in the product. You act on your own accounts, on your own terms.
Data handling
| Data | How it's treated |
|---|---|
| Your trader profile | Stored to personalize your answers. Reviewable and editable by you in Settings. Never sold. |
| Conversations | Retained to provide history, bookmarks, and session continuity. Used to improve your own experience. |
| Payments | Card payments are processed by established payment providers; elvaro does not store card numbers. Crypto payments settle onchain. |
| Market data | Sourced from established market data providers — public data, not yours. |
Platform security
All traffic is encrypted in transit. Authentication is handled by a dedicated identity provider with industry-standard token management. Production systems are monitored and error-tracked end to end, and every agent action is traced — the same observability that powers answer quality also powers incident response. Security headers, strict content policies, and least-privilege access are enforced across the platform.
What we will never do
Ask for your seed phrase or private keys. Request exchange API keys with withdrawal rights. Execute a trade on your behalf. Sell your personal data. DM you first — beware of impersonators; official communication comes only through the app, our verified channels, and this domain.