Your security
The honest version, including what a break-in here would and would not let an attacker do.
Last updated: 9 October 2026
We never ask for your seed phrase or private key
There is no field anywhere on this site that accepts one, and the API refuses wallet entries of that kind outright.
Anyone claiming to be us and asking for a seed phrase or private key is not us. Report it to the contact address below.
What we hold, and what it can do
Your Polymarket key lives in a vault that belongs to you, at Turnkey, and is imported there through Turnkey's own window: it is encrypted on your device before it leaves, so it never reaches our servers, our logs or even our page.
What we hold is a credential that your vault recognises as an ordinary, non-owner user. The permissions you grant it cover two things: proving your account to Polymarket's order book, and signing Polymarket orders for your own account.
It cannot sign a transfer, a token approval or any other message, because you never granted that and your vault refuses everything that was not granted. That is enforced by Turnkey's policy engine, not by a promise from us.
You can disconnect at any time — we stop signing immediately — and remove our user from your vault to make it final.
We will not claim we hold no credentials, because that would be false. The accurate claim is: we cannot move your money, and you can cut off our access.
If this platform were breached
An attacker could not withdraw or transfer anyone's funds, and could not read anybody's seed phrase or private key, because we never have them — they are in your vault, and our credential cannot export them.
An attacker could try to place bad orders for accounts that are connected. That is why the server enforces limits your own settings cannot raise: a hard ceiling per order and a maximum number of orders per minute, applied below the risk engine and closest to the money. Your own per-trade, daily, total-budget and open-position limits apply on top.
Disconnecting stops all of it immediately, and removing our user in Turnkey makes it permanent.
Account protection
Passwords are stored hashed, never in readable form.
Sign-in sessions use an httpOnly cookie that page scripts cannot read, and every refresh rotates the token; reusing an old one revokes the whole session family, which turns a stolen token into a locked door.
Repeated failed logins are rate-limited and then locked out for a period.
Use a password you do not use anywhere else, and keep in your Polymarket wallet only what you are willing to have traded.
Reporting a security problem
Write to the contact address below with enough detail to reproduce it. We would rather hear about a problem than read about it.