Your crypto history is sensitive. Coinfig is built so that connecting your accounts is safe by design: read-only wherever the exchange allows, encrypted, and POPIA-aligned.
Coinfig asks for read-only exchange API keys wherever the exchange offers them, and never for trading or withdrawal permissions. We use them to read your transaction history. One exchange bundles a data permission with moving funds inside your own account (AltCoinTrader Savings). There we tell you what else it allows and keep it optional.
API keys and other secrets are encrypted with AES-256-GCM, using keys derived via PBKDF2-SHA512. Credentials are never stored in plain text.
Sign-in is handled by a dedicated authentication provider with support for single sign-on, so your access is protected by industry-standard controls.
We do not sell your personal information. Access and consent events are logged for accountability, in line with South Africa’s POPIA.
Requests are rate-limited, traffic is served over HTTPS behind a global CDN, and the application uses standard security headers and parameterised database queries.
We collect only what we need to calculate your tax: your transactions and the accounts you choose to connect. Billing is handled by our payment provider; we do not store full card details.
Have a security question or want to report an issue? Email[email protected] and read how we handle personal information in our privacy policy.