# Security model

**How your Polymarket signer key is stored, encrypted, and used — and why we can never withdraw your funds.**

Section: Reference · Last updated: 2026-07-28

---

## Non-custodial by construction

Polyterminus is a trading interface. Your USDC and open positions live on Polymarket. Every trade signs against your own credentials on-the-fly. If our servers went dark tonight, your money and positions would be exactly where you left them on Polymarket tomorrow morning.

## Credential storage

  - Signer key: encrypted with AES-256-GCM at rest in Firestore
  - Encryption key held in Google Secret Manager (project polyterminus-eu)
  - Never logged, never returned to the client after storage
  - Access from our runtime only

## What the key can do

  - ✅ Place BUY / SELL orders
  - ✅ Cancel orders
  - ✅ Read positions and balances
  - ❌ Withdraw USDC or move funds off Polymarket
  - ❌ Sign arbitrary transactions

## Rotation + revocation

Rotate on Polymarket's side to invalidate our copy instantly. Or hit "Disconnect" in Account → Polymarket to delete our encrypted copy.

## Data residency

Everything in Google Cloud europe-west6 (Zurich, Switzerland). No user data leaves the EU except when explicitly sent to a third-party AI provider you've configured (BYO keys).