Why the bot runs on your server and holds your keys

There are two ways to run a trading bot for a client. It runs on their infrastructure with their keys, or it runs on the vendor's. The second is more convenient for everyone and it changes what the arrangement is.

What a hosted bot actually means

If the bot runs on the vendor's servers, then the vendor's infrastructure has your API keys. Which means:

• Their security is your security. Their breach is your breach.
• Their uptime is your uptime, and you have no visibility into it.
• Their business continuity is your trading continuity.
• You are trusting a control you cannot inspect, on an ongoing basis, indefinitely.

None of that requires anyone to behave badly. It is a description of where the risk sits.

The custody line

There is a bright line worth naming. A trading bot needs trade permission on an API key. It does not need withdrawal permission, ever, under any architecture.

With trade-only keys and your own infrastructure, the worst case of a total compromise is bad trading — real, bounded, and visible in your account. With withdrawal permission on someone else's server, the worst case is that the funds are gone.

The practical benefits, beyond risk

That last row is the one that matters most and gets considered least. Software on your own server keeps working when the relationship ends. That is not a small property for something that manages positions.

What it costs you

Honesty requires stating the downside: running it yourself means you own the operations. A VPS to pay for, a system to patch, monitoring to watch, an alert that wakes you.

That is real work, and it is why hosted arrangements are attractive. Our answer is to make the operational burden small rather than to take custody of it: containerised deployment, a systemd unit that restarts on failure, health endpoints, a Telegram control plane so day-to-day operation does not require SSH, and a runbook that says what each alert means.

For a single bot on one VPS, ongoing operations should be a few minutes a week. If a vendor tells you it must be more than that, they are describing their software rather than the constraint.

The reasonable middle

There is a legitimate arrangement between the two: the bot runs on infrastructure you own and pay for — your cloud account, your VPS — while the vendor has time-boxed operational access to deploy and debug.

You keep the keys, the account and the off-switch. They get enough access to do their job. Access is revocable in one action, from an account they do not control. That is the shape we recommend when a client genuinely does not want to operate it themselves.