Security

Apache holds real keys to real SOL on Solana mainnet. This page covers how those keys are kept, what Apache asks of you before money leaves a workspace, and why a dropped connection or a crashed server never sends the same money twice.

Keys stay on the server

Wallets are generated or imported on Apache's servers, and each key is encrypted on its own (AES-256-GCM, bound to the wallet's address, so an encrypted key can't be passed off as another wallet's). Keys sign on the server and never reach a browser, with one exception: an export you ask for on purpose.

• Only owners and admins can export, and only with two factor on and a fresh code.
• Each person can export 20 times an hour, up to 5,000 wallets each time.
• Every export is written to the workspace's record before any key leaves.

The details of import and export are in Import and export keys.

Two factor codes

Set it up under the header's account menu, Account: scan the code with Google Authenticator, 1Password, Authy or any authenticator app (or type the key), then enter a Code from the app. From then on it's asked at sign in, for key exports and for withdrawals.

Backup codes

For a lost phone: at sign in, Lost your phone? Use a backup code. Each works once. Make new codes replaces the set, and the old ones stop working.

Ask for the code on withdrawalson by default

Every withdrawal, and every new withdrawal address, asks for a code. Turning it off takes a code too; sign in and key exports keep asking.

Wrong codes5 in 15 minutes

Then codes are refused for 15 minutes, so nobody can guess their way in.

Turn off two-factor

Needs your password and a code. Without it, withdrawals go out without a code and keys can't be exported.

The same page lists your Sessions, the devices signed in, and changing your password signs you out everywhere else.

Where money can go

Members move SOL only between the workspace's own wallets. Sending outside is for owners and admins, and with Only to these addresses on (the default) only to the addresses saved in Settings → Withdrawal addresses.

1. 1
   Add the address

   Paste the Address, give it a Name (say, "Treasury Ledger"), enter a code if asked, and press Add (works in 24 h).

2. 2
   Wait a day

   It shows Active in N h until the 24 hours are up. The Send dialog lists it but won't let anyone pick it before then.

3. 3
   Withdraw

   Pick it under Send to in the Withdraw dialog, with a code when the account asks for one. Solana transfers are final.

Removing an address stops withdrawals to it at once; adding it back waits 24 hours again. Owners and admins can turn the list off (Off: any address, right away. Simpler, less safe.), which also asks for a code.

Saved before it's sent

Every transaction Apache sends is signed and written down, signature and all, before it leaves. That's true for bulk moves, warmups, launches, trades and burns alike.

• If the answer gets lost or the server restarts mid send, the very same transaction goes out again. It can land once at most.
• A new transaction is built only once the old one provably can't land: it expired and it's nowhere on chain. Three attempts at most.
• Transactions of a bulk move are simulated right before they're sent, so a doomed one fails before it costs a fee.

It runs on the server

Jobs, warmups, launches and exit rules all run on Apache's servers. Start one from your phone and close the tab: it keeps going. If the worker that runs them is offline, they wait and pick up where they stopped; nothing is lost.

Deliberate steps

The moves you can't take back each ask for something on purpose:

Bulk moves

A review first, saved as a draft that expires after 15 minutes, then Start.

Launch

Every balance read live, then the ticker typed in.

Panic sell

Two clicks, the second within four seconds.

Burn

A review planned on the server, then a confirmation with the exact tokens.

Stop a warmup · Cancel a job

Both ask first and say what happens to the rest.

Nothing stranded

• Relay hop wallets are created and their keys saved before any SOL moves into them. A stopped relay's parked SOL goes home with Return to … on its job page.
• A warmup sends every wallet's SOL home, or marks it Needs a look with the SOL still in it, where Collect works.
• A wallet that still holds funds can't be deleted. A deleted wallet comes back by importing its key again.
• Opening buys that would complete the bonding curve are refused before anything is signed.

Mainnet only

There is no devnet or test mode: every transaction is real and final. The routes that hide where SOL came from are in Routes: direct, relay, exchange, and how fees avoid linking your wallets is in Fees.