Your assets never leave your wallet to reach us, because they never reach us.

• No custody contract. We do not deploy a vault, a pool, or any program that takes possession of your tokens.
• No key storage. We do not collect, transmit, or store private keys or seed phrases — not in a database, not in a log, not in a backup.
• No admin key over your balance. We cannot move, freeze, seize, or claw back your funds. There is no button for it because there is no mechanism for it.
• If ruvv vanished tomorrow, your assets would be exactly where they are now — in your wallet, reachable from any Solana wallet or block explorer, with no action needed from us.

Wallet creation and key management run on Privy, an audited wallet infrastructure provider used across the industry.

• Keys are generated and used inside secure enclaves (TEEs) with key sharding, so no single party — including ruvv — ever holds a complete private key.
• Privy is independently audited and publishes its security architecture, penetration-test summaries, and SOC 2 reporting through its Trust Center.
• ruvv's servers receive your public address. That is all we need, and all we get.

We build a transaction and hand it to your wallet. It calls the same public, audited Solana programs everyone else calls.

• No custom ruvv swap contract. There is nothing we deployed sitting in the path that could redirect your output tokens or skim a hidden amount.
• Our fee is visible before you sign.The platform fee is a plain SOL transfer inside the same transaction — it shows up in your wallet's preview like any other instruction.
• Perpetualssettle through Orderly Network's audited vault and matching contracts, not through anything of ours.

The complete list of programs a ruvv transaction is allowed to call — verify any of these on a block explorer:

• Jupiter v6Swap routingJUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4
• pump.funBonding curve6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P
• PumpSwapGraduated AMMpAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA
• Raydium AMM v4AMM pools675kPX9MHTjS2zt1qfr1NYHuzeLXfQM9H24wFSUt1Mp8
• Raydium CLMMConcentrated liquidityCAMMCzo5YL8w4VFF8KVHrK22GGUsp5VTaW7grrKgrWqK
• Raydium CPMMStandard poolsCPMMoo8L3F4NbTegBCKVNunggL7H1ZpdTHKxQB5qKP1C
• Raydium LaunchLabLaunch curveLanMV9sAd7wArD4vJFi2qDdfnVhFxYSUg6eADduJ3uj

Fast trading uses a session key so you are not confirming every click. It is fenced in on purpose.

• The session key is generated in your browser. Only its public key is registered with our server — the private key never leaves your device.
• Every session transaction also needs a co-signature from our policy server, which refuses to sign unless all of the following hold: every program called is on the allowlist above; no program is hidden inside an address lookup table; the transaction contains no SPL Token Transfer, Approve, SetAuthority, or MintTo; SOL only moves to your own accounts, the published fee wallet, or a capped network tip; and the total stays under the per-transaction limit.
• Assets can leave the trading wallet in exactly one direction: back to the wallet you signed in with. Coins move with a TransferChecked whose destination the server re-derives itself, so both the mint and the receiving account have to match your own wallet — a stolen session key cannot name a different address.
• That co-signature is a veto, not custody. The server can only refuse. It holds no key that can spend your funds on its own, and it cannot originate a transaction you did not start.
• You pay your own network fees. The session key is the fee payer, so no third party is positioned to sponsor — or reroute — your transactions.