> For the complete documentation index, see [llms.txt](https://blackboard-fi.gitbook.io/blackboard-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blackboard-fi.gitbook.io/blackboard-docs/account/security.md).

# Security

Blackboard does not hold your assets. This page explains the security architecture and how to protect your account.

## Self-Custody Architecture

Every asset on Blackboard remains on-chain, controlled by your wallet.

* Trades are signed directly from your wallet
* Blackboard never has access to your private keys
* If Blackboard's servers go down, your assets are unaffected — manage them directly through Aster, Hyperliquid, or Polymarket

## Wallet Security

### Privy Embedded Wallet

* MPC (Multi-Party Computation) splits your private key into multiple shards — no single point of failure
* No third party, including Blackboard, can reconstruct the full key

### External Wallet

* MetaMask, WalletConnect, and other connected wallets follow their own security policies
* Hardware wallet connections (Ledger, Trezor) add an additional layer

## Session Key

A delegated key for trading convenience. Approve once, trade without wallet pop-ups.

| Permission                            | Allowed |
| ------------------------------------- | ------- |
| Execute trades (create/cancel orders) | Yes     |
| View positions                        | Yes     |
| **Withdraw funds**                    | **No**  |
| **Change keys**                       | **No**  |
| **Modify permissions**                | **No**  |

* Revocable at any time
* Managed by Privy's policy engine with automatic expiration
* Even if compromised, funds cannot be withdrawn

## Security Recommendations

### Essential

* Strong password + 2FA on your social login account
* Only use the official URL — watch for phishing sites
* Never share your seed phrase or private key with anyone

### Recommended

* Hardware wallet for large positions
* Periodically revoke unused Session Keys
* Check connected devices regularly

## Security Architecture

Blackboard does not deploy its own smart contracts. Crypto perpetuals settle on Aster, HIP-3 real-world asset perpetuals on Hyperliquid, prediction markets and options on Polymarket, and spot trading and trading cards on the on-chain protocols of the chain involved. All of them are independently operated, and Blackboard's role is limited to the interface and access layer.

## If Something Goes Wrong

### Blackboard servers down

Your assets are safe on-chain. Access the protocols directly:

| What you hold                                       | Where to access it                                             |
| --------------------------------------------------- | -------------------------------------------------------------- |
| **Crypto perpetual positions and collateral**       | [asterdex.com](https://asterdex.com) (connect the same wallet) |
| **HIP-3 real-world asset positions and collateral** | [app.hyperliquid.xyz](https://app.hyperliquid.xyz)             |
| **Prediction market and options positions**         | [polymarket.com](https://polymarket.com)                       |

Tokens held in your wallet, including spot assets and trading cards, can be accessed by connecting the same wallet to any other on-chain interface. Physical cards remain redeemable through CollectorCrypt.

### Suspicious activity detected

1. Revoke your Session Key immediately
2. Close all open positions
3. Withdraw assets to a secure external wallet
4. Report to <support@blackboard.fi>

## Next Steps

* [Account Creation](/blackboard-docs/account/account-creation.md) — Set up your account
* [FAQ](/blackboard-docs/resources/faq.md) — Security-related questions