Security
You keep the keys. We keep the surface small.
Vortif is an analytics interface, not a custodian. The security model follows from that: the fewer things we can do to your account, the fewer things can go wrong with it.
The posture
Non-custodial
Vortif never takes custody of your assets. There is no deposit address, no omnibus wallet, and no internal ledger of your balances. Your tokens stay where they are.
Keys never leave your wallet
Vortif has no ability to see, store, export or reconstruct a private key or seed phrase. Signing happens inside your wallet; we receive a signature, never the key that made it.
Read-only by default
The default session is a read. Vortif queries public chain state for your address and derives everything from it. Nothing moves without a transaction you explicitly approve.
Server-side API keys only
Provider and model keys live in server environment variables and are used only in route handlers. They are never inlined into the client bundle and never sent to the browser.
What connecting a wallet actually does
Connecting shares one thing: your public address. That is the same address anyone can already read on the block explorer. From it, Vortif queries public chain state - token balances and transfer history - and computes the rest locally and on our server.
A connection is not an approval. It does not grant an allowance, does not authorize a transfer, and cannot be used to move funds. Any state-changing action is a separate transaction that your wallet shows you and that you sign.
Disconnecting is immediate and entirely client-side. We do not need your permission to stop reading a public address, and we do not retain a session that outlives the connection.
Keys and secrets
- Your private keys: never transmitted, never stored, never requested. Vortif has no code path that asks for a seed phrase. Any site or message that does - including one claiming to be us - is an attack.
- Our provider keys: market data, news and model keys are read from server-only environment variables inside route handlers. The
server-onlypackage guards the modules that touch them, so an accidental client import fails the build rather than leaking a key. - No exceptions, including the RPC: wallet transports run client-side, so an RPC URL they use is public - which is why ours points at
/api/rpcon our own origin rather than at a node vendor. The credential stays server-side and the proxy allowlists read methods, so it cannot be used as an open relay or to broadcast transactions. The browser bundle ships zero credentials. See the docs.
Data handling
Vortif holds no user accounts, no passwords and no email list. Portfolio data is derived from public chain state on each request rather than warehoused.
When you use the AI advisor, the positions in scope are sent to a third-party model provider to answer the question. That is a real disclosure, not a formality: if you would not want a position summary leaving our infrastructure, do not query it. Details are in the Privacy Policy.
Honest limits
Non-custodial does not mean risk-free. Vortif does not remove smart contract risk, wallet compromise, phishing, upstream data errors, or liquidation risk on collateralized positions - and a security posture cannot compensate for a token that does not confer the rights you assume it does. Vortif has not been independently audited. Read the risk disclosures in full.
Reporting a vulnerability
Report suspected vulnerabilities to admin@vortifai.comwith enough detail to reproduce. Please do not disclose publicly until we have had a chance to respond, and please do not test against other users’ addresses or funds.