1. Keys Added in the Past
- API keys that some users added in the past were permanently deleted from our systems on October 24, 2026; they had not been used for any operation.
- The deleted keys also disappear from database backups, which are rotated within at most about 5 weeks.
- We also recommend revoking the key on your exchange's API management page.
2. Account Security
- All connections are encrypted with HTTPS/TLS; live data connections use WSS.
- Passwords are hashed one-way with bcrypt; even we cannot see your password.
- Session keys are kept in cookies that JavaScript cannot access (HttpOnly).
- You can turn on two-factor authentication (2FA) for your account in Settings.
3. General API Key Safety Tips
These are general rules to follow whenever you give exchange API keys to any software:
- Withdrawals: Never grant this permission to any software.
- IP Restriction: Restrict the key so it can only be used from specific IP addresses.
- Least Privilege: Enable only the permissions you really need.
- Sharing: Never share your API Secret with anyone; Next Candle will never ask you for it.
4. In Case of a Security Breach
If a security breach affects your personal data, the Turkish Personal Data Protection Board is notified within 72 hours as required by KVKK and affected users are notified as soon as possible; necessary measures such as password resets are taken.
5. Vulnerability Reports and Contact
If you notice a security vulnerability or have a question, write to nextcandle@upigai.com.