Security
Built to protect your account and your data.
Arena AI is built around one core security principle: your information should be safe, your sessions should be short, and your account should be easy to access without being easy to compromise. We do not hold bank details, wallet keys, or sensitive financial documents.
The first line of defense
No passwords. No leaks. No friction.
Passwords are the weakest link in most systems. They get reused, phished, leaked in breaches, and forgotten. We removed them entirely. When you want to enter the arena, you type your email, we send a one-time code, and you paste it in.
That code is valid once and expires quickly. It is not stored. If someone intercepts it, they have a narrow window to use it, and even then they only gain access to a platform account with no bank or exchange credentials on file.
For users, this means less friction and better security. For us, it means no password database to protect. The security model is simpler because the attack surface is smaller.
Protection layers
How we keep the arena secure
Passwordless login
Users sign in with an email and a one-time security code. No passwords to leak, no credential stuffing, and no password managers to forget.
Session expiry
Sessions are short-lived tokens stored in secure, httpOnly cookies. When the cookie expires or is cleared, the session is gone.
No financial credentials
We never collect bank details, wallet addresses, KYC documents, or any other financial identity information. There is nothing to steal.
Admin authentication
Admin access is gated by its own cookie and login flow, separate from the trader session. The arena is isolated from the control room.
Execution isolation
Positions, balances, and trades are stored in the running platform. They have no connection to live exchanges, bank accounts, or payment rails.
Transparent disclosure
Every page and footer clearly states that the AI executes on data, not certainty. We repeat it often on purpose.
Authentication
Sign in with email, not passwords
Passwords are the weakest link in most systems. They get reused, phished, leaked in breaches, and forgotten. We removed them entirely. When you want to enter the arena, you type your email, we send a one-time code, and you paste it in.
That code is valid once and expires quickly. It is not stored. If someone intercepts it, they have a narrow window to use it, and even then they only gain access to a platform account with no financial credentials on file.
For users, this means less friction and better security. For us, it means no password database to protect. The security model is simpler because the attack surface is smaller.
Data journey
What happens to your data
You enter your email
We generate a one-time code and send it to your inbox. The code is not stored beyond its short validity window.
You confirm the code
The code is checked, then immediately discarded. A session token is created and placed in a secure cookie.
The platform runs
Your balance, positions, and trades live in server memory while the session is active. No sensitive financial data is ever processed.
Session ends
When the cookie expires or you log out, the session is gone. The data remains in memory for continuity until the next deployment.
Operator controls
Controlled environments, safe classrooms
Arena AI is also built for operators who want to run controlled streams, classroom sessions, or guided sessions. The admin panel allows per-user settings for leverage range, risk per trade, enabled symbols, and even a target final balance for the next manual trade.
That target-balance feature is designed for preset outcomes. When set, the next manual trade will not liquidate or hit stop-loss. It will settle at the exact balance the admin specified. This is powerful for tutorials and dramatic reveals while keeping the experience transparent.
All admin actions are scoped to the platform. They cannot move funds, open live positions, or influence live markets. The control is total within the arena and zero outside of it.
Trade with confidence
Passwordless login, short-lived sessions, and no financial credentials on file. The arena is built to keep your information safe while the AI handles execution.
Go to Arena