API Security and Encryption

• AES-256 Encryption: Your API key and secret values are encrypted on the server side using the AES-256 algorithm.
• Encryption Key Isolation: The encryption key is stored in a secure environment separate from the database.
• Masking: In the user interface, your API key is shown masked, with only the first 6 and last 4 characters visible (e.g. ABcDeF...xYz1).
• No Plain Text: Your API keys are never transmitted in plain text to log files, error reports, or third-party services.

The following minimal permissions are sufficient for your exchange connection with Next Candle Predictor:

We strongly recommend setting an IP restriction on your exchange API key. This way, your API key can only be used from specific IP addresses, preventing misuse even in the event of a leak.

• All API communication takes place over HTTPS encrypted with TLS 1.3.
• WebSocket connections use the WSS (WebSocket Secure) protocol.
• Exchange API calls require each request to be signed with HMAC-SHA256.

You can remove your API key at any time via Settings → Exchange Connection. When the connection is removed:

• Your encrypted API keys are permanently deleted from our database.
• Your active positions remain as they are on the exchange (the platform does not auto-close positions).
• We also recommend that you delete the API key on the exchange side separately.

In the event of a possible security breach:

• Affected users are notified within 24 hours.
• All encrypted keys are immediately invalidated.
• Users are advised to renew their API keys on the exchange side.
• A notification is made to the relevant authorities within 72 hours under KVKK.

• Do not share your API keys with third parties.
• Do not grant Withdraw permissions.
• Set up IP restriction whenever possible.
• If you notice suspicious activity, immediately disconnect and contact us.

For questions related to API security:

Email: security@nextcandlepredictor.com