Security & custody

The custody design follows one rule: transaction keys never touch your browser. Everything below follows from that.

Sign-in

Accounts are created and authenticated with your email address, through hardware-backed key infrastructure provided by Turnkey. There is no seed phrase to write down or lose, and no browser extension to install. Because your keys are never generated or stored in the browser, there is nothing for a malicious webpage or a compromised extension to read or exfiltrate.

Sessions

After you sign in, your browser holds only a locked-down, HTTP-only session credential. Browser JavaScript cannot read that credential, and the credential itself cannot sign transactions; it only proves to the server which account is active. A session expires after a period of inactivity and is invalidated immediately on sign-out.

Signing

Transactions are signed inside an isolated signing service that holds end-user keys separately from the web application. When an action needs a signature, the terminal sends a signing request over an authenticated channel to that service; the service signs and returns only the signature. Raw private keys are never returned to the client, never logged, and never stored anywhere accessible from the browser.

Settlement

Positions execute and settle on an on-chain venue rather than in a private, internal database. Deposits, trades, and withdrawals are all verifiable on a public ledger, so your account activity is not something you have to take on trust.

What we will never ask

We will never ask for:

• Your password, one-time codes, or recovery codes.
• Remote-access software installed on your device.
• Funds sent to a "safe" address, a "verification" wallet, or any address we ask you to send to outside the terminal itself.

If you receive a message claiming to be from rwa.wtf asking for any of the above, do not respond to it. Our only support channels are email at admin@theindex.finance and X at @TheIndexFI; we will never contact you asking for credentials or a transfer through any other channel.