At rest
Keys encrypted with AES-256-GCM
Every API key and secret is encrypted before it is written to the database, with a key held outside it. In production the platform refuses to store a key at all if that encryption is not available.
Trust & security
Verify, don't trust.
Trust is easy to claim. So we publish things you can check yourself: your funds never leave your exchange, every release of the platform is timestamped on Bitcoin, and certificates, giveaway draws and affiliate payouts are on the record.
Non-custodial
Your funds stay yours
The Crypto Hub is software, not a custodian. Your crypto stays in your own exchange accounts; we connect to them with API keys you create and can revoke at any time.
What an API key can do here
- ReadUsedBalances, positions and trade history — enough for tracking and tax reports.
- TradeYour choiceOnly if you want to place orders from the Hub. Orders go to your own exchange account.
- WithdrawNeverWe never ask for it, and nothing in the platform can withdraw from your exchange.
In transit
TLS everywhere
The site and the API are served only over HTTPS, with HSTS so browsers never fall back to plain HTTP. Calls to your exchange are made over TLS from our servers.
Release timestamps
Every version, stamped on Bitcoin
Each production release is fingerprinted — its commit id (or, when a build doesn't carry one, its server revision and build id) plus its newest changelog entry — and the fingerprint is submitted to the free, public OpenTimestamps calendars, which anchor it in a Bitcoin block. After that, nobody can backdate or rewrite what we shipped.
Recent releases
How to verify a release
Download both files
Save the receipt (.ots) and the statement (.txt) for a release into the same folder. The statement is the exact text that was fingerprinted.Check the receipt
Drop the .ots file on opentimestamps.org and add the statement when asked, or use the open-source command-line client:ots verify thecryptohub-release-<id>.txt.otsRead the result
A confirmed receipt reports the Bitcoin block and its time: the release record existed by then. A pending one is still waiting for its block; download it again later.
The fingerprint is the SHA-256 of the statement file itself, so you can also recompute it:
shasum -a 256 <statement>.txtOn the record
Proof that lives on-chain
Where something matters to you — a certificate, a tax report, a prize draw, a payout — we publish it somewhere we can't quietly edit, and give you the link to check it.
Base
Academy certificates you can check
Academy certificates are issued as attestations on Base. Each certificate has its own public page, so an employer or client can check it without asking us.
Certificate linkthecryptohub.io/verify/certificate/<id>
Bitcoin
Every tax report is timestamped on Bitcoin
Your accountant can verify a report wasn't changed. On the report's verify page, drop in the file: it is hashed in the browser, compared with the hash we stored, and shown with its OpenTimestamps proof. The file itself is not uploaded.
Report linkthecryptohub.io/verify/report/<id>
Chainlink VRF
A giveaway draw anyone can re-run
Before the draw, the SHA-256 of the full ticket list is committed on-chain. The winners are then picked by Chainlink VRF inside a smart contract — no hand-picking, no do-overs.
Anyone can check that the published ticket list hashes to that commitment, that the VRF transaction produced the random number, and that the contract returns the published winning tickets.
On-chain
Every affiliate payout is verifiable on-chain
Our payouts page lists each affiliate payout with its date, amount and asset, a link to the transaction on a block explorer, and a shortened wallet address, added as each payout is made.
Crypto in, crypto out
Pay and get paid in crypto
A crypto platform should run on crypto. You can pay for your plan with it, and our affiliates are paid in it.
NOWPayments
Crypto checkout
Pay for any plan in cryptocurrency — BTC, ETH, USDT and more — through NOWPayments at checkout.
USDC · USDT · BTC · ETH
Affiliate payouts in crypto
Affiliates choose to be paid in USDC, USDT, BTC or ETH, sent to the wallet address they give us.
Security basics
The basics, done properly
No security page should be only about clever cryptography. These are the everyday protections, and how to reach us when something looks wrong.
TOTP
Two-factor sign-in
Turn on two-factor authentication with any authenticator app in your account settings. The secret behind your codes is encrypted at rest with AES-256-GCM as well.
security.txt
Report a vulnerability
Found a security issue? Email the contact in our security.txt with the details and steps to reproduce, and give us a chance to fix it before you share it publicly.
30 days
Data deletion on request
Ask from your account settings or by contacting us. Your account is disabled at once and your personal data is erased after a 30-day grace period.
FAQ
Questions people ask
Does The Crypto Hub ever hold my crypto?
No. Your funds stay in your own exchange accounts. We connect with read-only or trade API keys, never ask for withdrawal permission, and nothing in the platform can withdraw from your exchange.
How are my exchange API keys stored?
They are encrypted with AES-256-GCM before they are saved, and only decrypted on our servers to make a request to your exchange. Everything travels over HTTPS (TLS), and the site sends HSTS so browsers refuse plain HTTP.
What does a release timestamp prove?
That the record of a release — its commit id (or its server revision and build id) and its newest changelog entry — existed no later than the Bitcoin block its receipt points to. Nobody, including us, can backdate or edit that record afterwards without the receipt failing to verify.
Why does a release say “Waiting for Bitcoin”?
The free OpenTimestamps calendars collect many fingerprints and write them into one Bitcoin transaction, which usually takes a few hours. The receipt is upgraded automatically once that block is mined; download it again to get the complete proof.
Do I have to trust you to check a receipt?
No. OpenTimestamps is an open standard. You can check a receipt at opentimestamps.org or with the open-source ots client against Bitcoin itself — our servers are not involved in the check.
How do I check an Academy certificate?
Academy certificates are issued as attestations on Base. Open the certificate's link, thecryptohub.io/verify/certificate/ followed by its id, to check it.
How do I report a security issue?
Email the contact listed in our security.txt file at thecryptohub.io/.well-known/security.txt with the details and steps to reproduce. Please give us a chance to fix it before you share it publicly.
Can I have my data deleted?
Yes. Request it from your account settings or by contacting us. Your account is disabled straight away, and after a 30-day grace period your personal data is erased. The privacy policy lists exactly what is deleted and the few records that are kept in anonymised form.
More on how exchange connections work: platform features.