LockstepMarkets

Security

How we store your data and, if you use copy trading, your trading key — including the parts that are a trade-off rather than a guarantee. It describes what the software actually does. If anything here does not match what you see, email hello@lockstepmarkets.com.

Last updated 26 September 2026

The short version Analysing wallets needs only public addresses, and most people never give us a key. If you switch on copy trading, you give us the private key of a trading wallet. We encrypt it and store it, and the bot decrypts it to sign your orders. The encryption key is on the same server as the database, so someone who took full control of that server could decrypt stored keys.

A private key is complete control of its wallet: whoever has it can move everything in it. So use a separate wallet, keep a small balance in it, and delete the key when you stop copying.

What we store

Everyone	Your email address; your password, stored only as a scrypt hash; whether your email is verified, when you joined and which version of the Terms you accepted; a referral code; a username if you set one; the wallet addresses you track, your settings and your simulated trading history. Your login cookie is stored on our side only as a hash.
Two-step verification	If you turn it on: the authenticator secret, encrypted the same way as trading keys, and your backup codes, stored only as hashes.
If you pay	Your subscription state from Stripe, and the record of the confirmation you gave at checkout, with the IP address and browser it came from. Never your card details — Stripe handles those and they never reach us.
If you copy trade	The private key of your trading wallet, encrypted. Stored beside it, not encrypted: the wallet’s public address, your Polymarket proxy address if you gave one, and which kind of Polymarket account it is.
To keep the site running	Your IP address while you sign up, sign in or reset a password, to limit repeated attempts; and server logs.

The Privacy Policy has the full list, why we hold each item and how long we keep it.

How a trading key is stored

On the way in. The key travels over HTTPS. The server checks it is a valid key, works out the wallet’s public address from it, and encrypts it before it is stored.
The encryption. Fernet: AES-128 in CBC mode, authenticated with HMAC-SHA256, so an altered or damaged copy is rejected rather than decrypted into something wrong.
Where. In the application’s database, on a dedicated server run by Vultr in Querétaro, Mexico.
Never sent back. No page and no response from our server ever returns the key — not to you, and not in any admin view. The app only ever shows the wallet’s public address.
When it is decrypted. While copy trading is switched on, the server decrypts the key and gives it to Polymarket’s trading software, which keeps it in memory to sign your orders. That is replaced at least every hour, and discarded when copying stops: straight away if you switch it off, or within about a minute if it stops for another reason, such as a subscription ending. The key is also decrypted if you press One-off on-chain approvals, which sends the six transactions a brand-new wallet needs before Polymarket’s exchange can trade with its funds.
What it is used for. Only those two things. Our code has nothing that withdraws or transfers money out of your wallet.
Never written down. Our code never writes the decrypted key to disk or to a log. Logs record at most the first few characters of a wallet’s public address.
Error reports. Sending error reports to an outside service (Sentry) is currently switched off, so none leave the server. If we switch it on, every report has request contents and cookies removed, and anything shaped like a private key replaced with [redacted], before it is sent.

Where the encryption key lives

The key that encrypts stored trading keys is kept in a configuration file on the same server, readable only by the server’s administrator account, and handed to the application when it starts. It is not in the database, not in the backups and not in our code repository, and we keep no other copy of it.

That cuts both ways, and you should know which way:

Encryption protects stored keys if the database or a backup leaks on its own. It does not protect them if someone takes full control of the server, because the encryption key is there too.
If the server were destroyed, stored keys could not be recovered and you would enter a key again. Your funds would not be affected: they are in your wallet, not with us.

Who can reach it

The application, in the ways described above.
Anyone with administrator access to the server, which means:
- Daniel Montgomery-Smith, who runs Lockstep Markets, using an SSH key;
- our automated deployment — when new code is published to the project’s GitHub repository, GitHub Actions installs it on the server with its own key, so anyone who took over that GitHub account could reach the server;
- Vultr, who host the server, as any hosting company can reach the machines it runs.
Nobody else. There are no staff or support agents, and no screen anywhere in the app that shows a key.

Card payments are handled by Stripe. Cloudflare registers our domain name and runs its DNS; your traffic does not pass through Cloudflare.

Deleting your key

Settings → Copying for real → Delete key, then confirm. It removes the encrypted key from the database, switches copy trading off and discards the decrypted copy held in memory. You can do this at any time without closing your account.

The key is erased from the database file itself at once — overwritten, not just marked as free space. The one place encrypted copies remain is our nightly database backups, for up to 14 days, after which they are deleted.

Deleting a key stops us using it. It cannot make safe a key that may already have been exposed. If you think yours has been, move your funds to a new wallet.

Closing your account

Settings → Delete this account, with your password. Your trading key is deleted first, before anything else, and the decrypted copy in memory with it. Then any subscription is cancelled with Stripe, then your account and its data are removed — except the payment records the law requires us to keep, which the Privacy Policy lists. The same 14-day backup window applies.

If there is a breach

If our server were ever compromised, we would:

switch off copy trading for every account straight away, so no stored key is used;
email everyone affected within 24 hours of finding out, saying what happened and telling you to move your funds out of your trading wallet;
delete every stored key and replace the encryption key — to copy again you would set up a new wallet, because the old one should be treated as exposed;
report it to the Information Commissioner’s Office within 72 hours, where the law requires it.

What you can do

Use a wallet that exists only for copy trading, never your main one, and keep a small balance in it — only what you are prepared to lose. The key form says the same, because that is the moment it matters.
Turn on two-step verification in Settings.
Delete the key when you stop copying.
Never give anyone your seed phrase. We never ask for one, and the key form refuses one if it is pasted.

Reporting a problem

If you find a security problem, email hello@lockstepmarkets.com. It reaches the person who wrote the software.

More: About Lockstep Markets · FAQ · Getting started · Terms of Service · Privacy Policy

← Back to the app