Credentials, permissions, and execution controls.
Security is part of the operating model: encrypted secrets, least-privilege exchange keys, bounded risk, and an auditable trail.
Encrypted API keys
Exchange credentials are encrypted at rest. Secrets are never written to application logs or exposed through the API.
Least-privilege keys
Trade-only API keys are recommended. Withdrawal permissions are not required. IP allowlists and key rotation are supported by the exchange model.
Permission isolation
Users and strategies are separated by account and role. Administrative actions are explicitly permissioned.
Audit trail
Order, fill, position, strategy, and risk events are recorded for review and incident investigation.
Safe license expiry
Expiry stops new deployments and new trade starts; existing protective orders are handled through a controlled wind-down, not an abrupt shutdown.
Responsible disclosure
Report security issues to 573830039@qq.com. We will acknowledge and investigate.
Security boundaries
SUQIAN QUANT is software. It does not custody customer funds, does not require withdrawal-enabled keys, and does not make trading decisions on behalf of customers. Customers remain responsible for exchange accounts, API permissions, capital, and compliance in their jurisdiction.