> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fees.fun/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How fees.fun protects your wallet keys and keeps your funds safe.

## Your keys, your control

fees.fun **does not store any private keys in our database**. We literally can't — we don't have them. Wallet key management is handled entirely by [Turnkey](https://www.turnkey.com/), a non-custodial key infrastructure provider. Your keys never touch our servers in any stored form.

## How wallets work

<Tabs>
  <Tab title="Wallets created in fees.fun" icon="plus">
    When you create a wallet in fees.fun, it's generated through **Turnkey**. Each user gets their own isolated sub-organization in Turnkey's infrastructure. The private keys live in Turnkey's secure hardware environment — not in our database, not on our servers.

    Turnkey is a professional non-custodial key management provider used across the industry. Your keys are managed with hardware-level security and never exposed to us.
  </Tab>

  <Tab title="Imported wallets" icon="file-import">
    When you import a wallet, the private key is sent straight to **Turnkey** — the same secure infrastructure that handles created wallets. It's stored in your Turnkey sub-organization with the same hardware-level security. We never store imported keys in our database either.

    Created or imported — all your keys end up in the same place: Turnkey's secure infrastructure, not on our servers.
  </Tab>
</Tabs>

## What we can and can't do

|              |                                                                                    |
| ------------ | ---------------------------------------------------------------------------------- |
| **We can**   | Sign transactions on your behalf when you initiate a trade                         |
| **We can't** | Access your keys — they're in Turnkey's infrastructure or encrypted on your device |
| **We can't** | Store your private keys — we have no database table for them, period               |
| **We can't** | Move funds from your wallet without a transaction you triggered                    |

## What we store on our servers

| Data                           | Stored? | Where?                                      |
| ------------------------------ | :-----: | ------------------------------------------- |
| Private keys                   |  **No** | Turnkey (both created and imported wallets) |
| Username & password hash       |   Yes   | Our database                                |
| Transaction history            |   Yes   | Our database                                |
| Wallet addresses (public only) |   Yes   | Our database                                |
| Referral data                  |   Yes   | Our database                                |

<Warning>We store **zero private keys** in our database. All wallets — whether created or imported — are managed by Turnkey's secure infrastructure.</Warning>

## Data in transit

All communication between the extension and our servers is encrypted:

* **HTTPS** for all API calls
* **WSS** (encrypted WebSockets) for real-time connections
* **JWT authentication** on every request — no one can impersonate your session

## FAQ

<AccordionGroup>
  <Accordion title="Do you store my private keys?">
    No. All wallets — created or imported — are stored in Turnkey's secure infrastructure. We have no private keys in our database, period.
  </Accordion>

  <Accordion title="What is Turnkey?">
    Turnkey is a non-custodial key management provider. They handle wallet creation and key storage using hardware-level security. Each fees.fun user gets their own isolated sub-organization in Turnkey — your keys are completely separate from every other user.
  </Accordion>

  <Accordion title="Where does my imported key go?">
    Straight to Turnkey. When you import a wallet, the private key is sent directly to Turnkey's secure infrastructure — the same place created wallets are stored. It never touches our database.
  </Accordion>

  <Accordion title="What if fees.fun gets hacked?">
    An attacker who accessed our servers would find no private keys — because we don't have any. All keys are stored in Turnkey's secure infrastructure, not on our servers.
  </Accordion>

  <Accordion title="Can fees.fun move my funds without my permission?">
    fees.fun only signs transactions that you initiate by clicking a button on the platform you're using. There's no background process that moves funds.
  </Accordion>

  <Accordion title="What encryption is used?">
    * **Turnkey** for all wallet key management (hardware-level security)
    * **HS256 JWT** for session authentication
    * **HTTPS / WSS** for all data in transit
  </Accordion>
</AccordionGroup>