Security, built in.
Executor trades with your wallet, so every layer was built for the worst case. Here’s exactly what protects you.
Your keys stay with Privy.
Privy creates and protects your wallet inside an isolated environment (TEE). Executor never sees or stores a private key.
Permission, not possession.
Executor gets two limited permissions, each with its own policy at Privy: selling positions, and buying with the guardian’s signature, always through Jupiter and within the cap. They only apply to the trading wallet, separate from your main wallet. No withdrawals and no transfers. Revoke in the app whenever you want: then it stops buying and selling.
The AI never trades on its own.
The AI talks and proposes the strategy. It can’t switch on, pause, buy or sell: only your click activates it, and the engine does the trading, with fixed rules.
A server just for the engine.
The engine runs on a server separate from the site, with a firewall, key-only access and a signature on every request between the two. It checks each transaction before asking for a signature.
Chat history encrypted on your device.
AES-256-GCM in your browser, with a key that can’t be exported. Erase it whenever you want.
Payments handled by Stripe.
Card details go straight to Stripe, certified PCI DSS Level 1. They never reach our servers.
Why can’t an AI chat be end-to-end encrypted?
An AI has to read a message to answer it, so no AI chat can be sealed like a private messenger. Here’s what we do instead: messages travel only over HTTPS, history is encrypted on your device, images lose their location and photo data before they leave your device, voice turns into text on the device whenever the browser allows, and your money’s safety never depends on what the chat says.
Under the hood
- HTTPS everywhere, with HSTS
- Content Security Policy with a per-request nonce
- Integrity hashes (SRI, SHA-384) on core scripts
- Cross-origin isolation headers (COOP and CORP)
- No framing by other sites (clickjacking blocked)
- Fonts and files served from our own domain
How to report a security flaw.
Found a security flaw in Executor? Tell us first, privately, so we can fix it before anyone uses it.
- Email suporte@executor.fun with “Security” in the subject: what you found, where, and the steps to reproduce it.
- In scope: executor.fun, the app, its API and @ExecutorFunBot. Out of scope: services we use but don’t run, like Privy, Stripe, Jupiter, pump.fun and Telegram (report to them), plus load or denial-of-service tests, spam and social engineering.
- We confirm we got your report within 2 business days and keep you posted until it’s fixed.
- If you act in good faith, we won’t take legal action against you: test only with your own account and wallet, don’t access, change or delete other people’s data or money, don’t disrupt the service, and give us reasonable time to fix it before making it public.
- There’s no reward program for now.