Privacy & Security

“Is it safe to connect my exchange to KoinX?” — it’s the first thing most people wonder, and rightfully so. You’re trusting a third-party platform with access to your financial data. This page explains exactly what KoinX can and cannot see, how your data is protected, and what you should never share with anyone — including KoinX support.

---

​

What Data Can KoinX Access?

The data KoinX can see depends on your integration method:

​

API Integration

When you create an API key on your exchange and paste it into KoinX, KoinX uses that key to read your transaction history. This includes trades (buys, sells, swaps), deposits, withdrawals, and — depending on the exchange — futures trades, staking rewards, and other activity. What KoinX CAN see:

• Your trade history (what you bought, sold, and when)
• Deposit and withdrawal records
• Fee information
• Account balances (read-only)

What KoinX CANNOT do:

• Place trades on your behalf
• Withdraw or transfer any funds
• Change your account settings
• Access your exchange password

This is because you should only grant read-only permissions when creating your API key. Most exchanges make this very clear during key creation — never check boxes for “trade”, “withdraw”, “transfer”, or “futures creation”.

​

Direct Connect

With Direct Connect, you do not enter your exchange login credentials inside KoinX. Instead, you open your exchange app or website and click on “Tax Report with KoinX” from within the exchange itself. The permission is granted directly by the exchange.KoinX does not request your login, password, or authentication details. What KoinX CAN see:

• Trade history
• Deposits and withdrawals
• Other transaction data shared by the exchange

What KoinX CANNOT see or do:

• Your exchange login password
• Your 2FA codes
• Place trades or move funds
• Access anything beyond what the exchange explicitly allows

If you want to stop Direct Connect, you simply remove the integration from the Integrations page in KoinX. There is no separate revoke button.

​

Blockchain / Wallet Integration

For on-chain wallets (MetaMask, Phantom, Ledger, etc.), you only provide your public wallet address — the same address anyone can look up on a block explorer like Etherscan. What KoinX CAN see:

• All on-chain transactions linked to that public address (token transfers, DeFi interactions, NFT activity)

What KoinX CANNOT see or access:

• Your private keys
• Your seed phrase / recovery phrase
• Your wallet password
• Any ability to sign transactions or move funds

Sharing your public address is like sharing your email address — people can see what was sent to you, but they can’t send emails as you.

​

File Upload / Custom File

When you upload a CSV or custom file, KoinX only receives the data in that file. It has no ongoing connection to your exchange — it’s a one-time data transfer.

---

​

What You Should Never Share

This applies to KoinX, KoinX support agents, and any third-party platform: Never share your:

• Exchange login password
• Private keys (for any blockchain wallet)
• Seed phrase / recovery phrase (the 12 or 24 words)
• API keys with withdrawal or trading permissions enabled
• 2FA backup codes
• OTP codes with anyone who contacts you first

KoinX will never ask for any of the above. If someone claiming to be from KoinX asks for your password, seed phrase, or an API key with withdrawal access — it’s a scam. Report it immediately.

---

​

How Your Data Is Stored

KoinX takes data security seriously:

• Encryption in transit — All data between your browser and KoinX servers is encrypted using HTTPS/TLS
• Encryption at rest — Your transaction data and API keys are encrypted when stored on KoinX servers
• Access controls — Only authorised KoinX systems can access your data for processing
• No credential storage — For Direct Connect (OAuth), KoinX never stores your exchange password. For API, your Secret Key is encrypted and only used for syncing

---

​

Revoking Access

You can cut off KoinX’s access to your data at any time: For API integrations: Log into your exchange, go to API Management, and delete or revoke the API key you created for KoinX. KoinX will immediately lose the ability to sync new data. Existing data already imported into KoinX remains until you delete the integration. For Direct Connect: Go to your exchange’s authorised apps or connected applications settings and revoke KoinX’s access. The OAuth token becomes invalid immediately. For Blockchain wallets: There’s nothing to revoke — KoinX only reads public blockchain data. You can remove the integration in KoinX, but the public address data is always available on the blockchain to anyone. For File Uploads: There’s no ongoing connection to revoke. The data exists only within your KoinX account. Delete the integration to remove it.

---

​

Should I integrate even if I’m worried about Security?

Yes — here’s why: The risk of not integrating is actually higher than the risk of integrating. If you skip exchanges or wallets because of security concerns, your tax report will be incomplete. Incomplete reports can lead to incorrect tax filings, which create real legal and financial consequences. KoinX’s read-only access model is specifically designed to make integration safe. You’re sharing the same data your exchange already reports to tax authorities in many jurisdictions. The difference is that KoinX helps you organise and calculate it correctly. If you’re still uncomfortable with API or Direct Connect, use File Upload or Custom File — these methods don’t create any ongoing connection. You download your data from the exchange yourself, upload it to KoinX, and there’s no persistent access.

---

​

Common Issues / Edge Cases

I accidentally shared my Secret Key / Passphrase with someone

Immediately log into your exchange, revoke the compromised API key, and create a new one. If your exchange password was also shared, change it immediately and enable 2FA if you haven’t already. Update the new API key in KoinX.

Someone from KoinX support asked for my password

This is a scam. KoinX support will never ask for your exchange password, seed phrase, or private keys. Report the incident to KoinX through the official chat widget or website.

I created an API key with full permissions by mistake

Revoke it on your exchange immediately. Create a new key with read-only permissions only. Update the key in KoinX. As long as no one else has the old key, no damage was done — but don’t leave over-permissioned keys active.

Can KoinX integrate on my behalf if I share my credentials?

No. KoinX will never ask you to share your login credentials. The integration process is designed to be done by you, directly. If you need help, KoinX support can guide you through the steps — but they should never need your password or secret keys.

---

​

Frequently Asked Questions

---

​

What’s Next?

• Getting Started with Integrations — Ready to connect your first exchange? Start here
• API Integration Guide — Detailed walkthrough for setting up read-only API keys
• Blockchain & Wallet Integration — Connect wallets using just your public address
• Choosing Your Integration Method — Not sure which method is safest for you? Compare them here