Security & custody

Normal mode: non-custodial

In normal mode, Sidekick never holds your funds or keys.

  • Sign-in uses a message signature (Sign-In With Solana). It can't authorize a transfer.
  • Trades are built on our server and signed in your wallet. The server never sees your private key.
  • Your session is stored in a secure, HTTP-only cookie tied to your wallet address.

Auto mode (experimental): policy-controlled agent wallet

For the agent to trade while you're away, it needs a wallet it can sign with. Auto mode uses a separate agent wallet, and its key is held in secure key-management infrastructure (provider TBD). That means auto mode is not non-custodial. We limit the risk like this:

  • The agent wallet is separate from your main wallet and only holds what you deposit.
  • Every transaction is checked against your limits (per-trade cap, daily cap, allowed tokens, max slippage) before it can be signed.
  • The agent wallet can only swap. Withdrawals can only go to your own main wallet.
  • You can pause auto mode and withdraw at any time.

See Auto mode for details.

Protect yourself

  • Never share your seed phrase. No one from the team, and not the agent, will ever ask for it.
  • Read what you sign. Your wallet shows the tokens and amounts in every transaction. Reject anything unexpected.
  • Check the URL. Bookmark the official site. Scam sites copy popular projects.
  • Verify the mint address. The official $SIDEKICK mint is 8DcJpVmU8juZbbyUrKSdvy2E3q7euVJuaofsdhYxtzXv. Copycat tokens often use the same name and ticker.
  • Start small with auto mode. Only fund the agent wallet with amounts you're comfortable letting an experimental system trade.

What data we see

  • Your public wallet address, and the public balances anyone can see on-chain
  • Chat messages you send to the agent, which are sent through OpenRouter to the AI model you pick (for example Anthropic, OpenAI, or Google) to generate responses. Those providers handle the data under their own policies.
  • For auto mode: the limits you set and the agent's activity log

We don't sell your data.

Reporting a vulnerability

Email TBD. Please don't disclose it publicly until we've had a chance to fix it.

← Fees & buybacksRoadmap →