Where your money sits
This is the question that matters most, so it gets a page of its own.
Taba never holds your funds
There is no Taba balance, no Taba deposit address, and no withdrawal from Taba. Your money is either in your own wallet or in your account at a venue. Nothing sits with us in between, and there is nothing for us to lose, freeze or abscond with.
Your wallet is yours
The wallet created at sign-in is an embedded wallet you control. You can export its private key from Settings at any time, and once you have, it works anywhere — Taba is not required to reach it.
The flip side: losing access to your sign-in method can mean losing access to that wallet. Export the key.
Trading keys can trade, not withdraw
Signing every order with your wallet would mean a prompt for every click. Instead, where a venue supports it, Taba uses a delegated trading key — an "agent" — authorised to place and cancel orders and nothing else.
It cannot withdraw. It cannot transfer. It cannot move your funds anywhere, because the venue itself will not let it. That limit is enforced by the venue, not by us promising to behave.
These keys are stored encrypted on the server so orders can be signed without a wallet prompt each time. Venue API keys, for the venues that connect that way, are stored the same way.
The trade-off. Server-held trading keys are what make one-click orders and market-making bots possible. If the server were ever compromised, someone could place orders with those keys — they could not withdraw, but bad orders can still lose money. If that trade-off is not one you want, connect only venues that sign in the browser, and do not run bots.
What to do about it
- Export your wallet key and store it offline.
- Create venue API keys with trading permission only, never withdrawal.
- Revoke connections you are not using, from Taba or from the venue.
- Spread funds across venues rather than concentrating them in one.
- Keep on a venue only what you are actively trading.