Local credentials
Imported credentials are encrypted in app-private storage using an Android Keystore-backed key. They are not sent to Citrine Edge for remote custody.
Security and control
Your account. Your device.
Your funds stay with Coinbase. Imported API credentials stay encrypted on your Android device, not in a Citrine cloud trading account.
Minimum permissions
View permission supports account access. Real trading additionally requires Trade. Citrine does not require Transfer, Receive or withdrawal permissions.
Protected access
Android device security and Citrine's app-lock gate protect access to the workspace. Keep your operating system and device secure.
Position protection
Some protection belongs at the exchange.
With Complete and eligible trading access, Citrine uses Coinbase-hosted stop-loss and take-profit orders alongside its own position monitoring and exit management.
Existing Coinbase orders are not dependent on the phone rendering a chart. But order rejection, price gaps, insufficient liquidity, exchange issues and other conditions can still prevent the intended execution. Stops are not guarantees.
Local execution has responsibilities.
Use reliable connectivity, keep the device powered and follow the app's notification and background-operation setup. After a restart or interruption, review Citrine's status and verify positions directly at Coinbase. Do not assume trading resumed automatically.
Pause holds new entries while eligible open-position management can continue. Exit Citrine stops the local runtime. It does not automatically close positions or remove existing exchange orders.
Keep monitoring separate from management.
A dedicated phone or tablet can run Standard Mode while another device uses Observation. Observation does not place trades or manage protection, including manual closes. For urgent action, use Coinbase directly.
What still uses network services?
Account requests go directly to Coinbase. Google Play and Citrine's verification service confirm paid access. Market archives, notices and support use network services. Local credentials do not mean the entire product is offline or that no data is processed.
A few important habits
- Import API keys only inside Citrine, never into a website or support form.
- After import, securely remove exposed copies of the original key file when no longer needed.
- Revoke the key directly at Coinbase if a device is lost or compromised.
- Review Android lock-screen notification settings; trading notifications may show financial information.
- Keep direct access to Coinbase available for account and position emergencies.