# Security & egress IPs

_Last updated: July 2026_

## The IP address to allow-list

All BTCMatic exchange traffic originates from a single static IP address. When you create your **trade-only** API key on Binance (or another supported exchange), restrict it to exactly this address:

`5.75.222.186`

- On Binance: API Management → your key → "Restrict access to trusted IPs only" → add `5.75.222.186`.
- Key validation checks this restriction — a key that is not IP-restricted, or restricted to a different address, is rejected at setup.
- This address is dedicated to order execution only — it is separate from the IPs serving our website and API.
- If this address ever has to change, we will notify you well in advance; your key would otherwise stop working.

## Why we require it

With the allow-list in place, your API key is useless from anywhere else on the internet. Even if the key leaked, an attacker could not use it — requests from any other IP are refused by the exchange itself.

## The rest of the model

- **Non-custodial.** We never hold funds. Alerts read public chain data; orders run on your own exchange account.
- **Trade-only keys, enforced.** Exchange keys are accepted only after a live permission probe; any key carrying withdrawal scope is rejected. Your rules cannot withdraw from your exchange account — by construction, not by promise.
- **Optional Lightning billing (NWC), honestly described.** If you enable sats auto-renewal, you hand us a Nostr Wallet Connect link that technically CAN spend — which is why it is budget-capped in _your_ wallet at roughly the plan fee per month, revocable by you at any moment, encrypted at rest, and used by exactly one code path: paying your own subscription invoice. It is never available to rules, orders or any other part of the system, and BTCMatic works fully without it.
- **Envelope encryption.** Keys are sealed per account with AES-256-GCM data keys wrapped by a hardware KMS, decrypted only inside the isolated order-execution service, and never written to logs.
- **Blast-radius isolation.** Only the order executor can decrypt keys or reach exchanges; the API, engine and adapters cannot.
- **Signed webhooks.** Every webhook delivery is signed (HMAC-SHA256) with your endpoint's secret, so your systems can verify it came from us.
- **Immutable audit.** Every fire, order and key validation is recorded and visible to you, including the full evaluation trace of why a rule fired.

Questions or something to report? `security@btcmatic.com` — see also our Terms (https://btcmatic.com/legal/terms) and Risk disclosure (https://btcmatic.com/legal/risk). Security contact file: https://btcmatic.com/.well-known/security.txt

---

Canonical page: https://btcmatic.com/security  
Machine index: https://btcmatic.com/llms.txt · Agent notes: https://btcmatic.com/agents.md