# Security Architecture

> Source: https://www.archr.bot/docs/security-architecture
> Section: Security
> Last updated: 2026-07-27

ARCHR is a non-custodial trading bot — your keys, your coins. The system is designed so that sensitive data is encrypted at rest, ephemeral in transit, and never exposed in logs.

---

## Private Key Encryption

- All wallet private keys are encrypted with **AES-256** before being stored in the database
- Keys are **never stored in plain text** and **never appear in logs**
- Encryption uses a unique random IV per operation, preventing identical plaintexts from producing identical ciphertexts
- The encryption key is stored as an environment variable, separate from the database

## Agent API Key Encryption

If you use the AI Agent (BYOK model), your provider API key (OpenAI or Anthropic) is encrypted with the **same AES-256 scheme** as private keys:

- Encrypted before storage, decrypted only at the moment of an LLM call
- Never logged or exposed in error messages
- API keys are validated against the provider on save — invalid keys are rejected immediately

## Sensitive Message Handling

ARCHR automatically protects sensitive information in Telegram messages:

- **Private key display** uses Telegram's spoiler blur — tap to reveal
- **Copyable key messages auto-delete after 30 seconds**
- **Imported private key messages are immediately deleted** from the chat
- You can manually delete key messages at any time using the Delete & Return buttons

## User Authentication

- Authentication is handled through **Telegram's infrastructure** — your Telegram account is your identity
- Each user is uniquely identified by their Telegram ID
- No separate passwords or sessions to manage
- Protect your Telegram account with **two-factor authentication** for the strongest security

## Transaction Security

- **Priority fees** are used to improve transaction reliability and reduce the chance of failed or front-run trades
- **Slippage settings** let you control maximum acceptable price deviation
- All trade execution goes through Jupiter's routing for best-price aggregation
- The bot validates transaction parameters before signing and submitting

## What ARCHR Does Not Do

- ARCHR **never has access to your funds** outside of the transactions you initiate
- ARCHR **never shares your keys** with third parties
- ARCHR **never stores unencrypted keys** anywhere — not in memory logs, not in error reports, not in analytics
- There is no "admin override" to access your wallet — if you lose your key, the funds are unrecoverable