> For the complete documentation index, see [llms.txt](https://docs.husher.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.husher.io/documentation/security/security.md).

# Security

How Husher's non-custodial design creates security through structural separation, not policy promises

Husher is built on a non-custodial foundation. Security begins with the structural fact that Husher never holds, controls, or has access to user funds at any point in a standard swap. There is no internal balance, no hot wallet, and no custody layer for an attacker to compromise.

In a standard swap, the security model works through clear separation: users control their own keys, Exchange Service Providers handle execution briefly, and Husher acts solely as a routing and orchestration interface between them.

{% hint style="info" %}
Security in this model comes from structural boundaries, not promises. Understanding where each party's control begins and ends is the starting point for using Husher safely.
{% endhint %}

### Security model at a glance

| Area                                      | Who controls it           | Husher's exposure |
| ----------------------------------------- | ------------------------- | ----------------- |
| Private keys and wallets (standard swaps) | You                       | None              |
| Deposit address generation                | Exchange Service Provider | None              |
| Trade execution and settlement            | Exchange Service Provider | None              |
| Routing and orchestration                 | Husher                    | No custody taken  |
| Delivery to destination wallet            | Exchange Service Provider | None              |

{% hint style="warning" %}
One exception applies to the table above. Batch & Collect's optional **Automatic Mode** is the only flow where you choose to share private keys with Husher. When you do, the keys are used solely to perform the collection and are then discarded; they are not stored, logged, or retained. Every other swap, including Batch & Collect Manual Mode, follows the key-free model above. See [Key Ownership](/documentation/security/security/key-ownership.md).
{% endhint %}

### Explore the security section

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Key Ownership</strong></td><td>When Husher does and does not interact with private keys, and why standard swaps never require them.</td><td><a href="/documentation/security/security/key-ownership.md">Key Ownership</a></td></tr><tr><td><strong>Fund Flow</strong></td><td>How funds move from your wallet to destination without passing through Husher.</td><td><a href="/documentation/security/security/fund-flow.md">Fund Flow</a></td></tr><tr><td><strong>ESP Role</strong></td><td>What Exchange Service Providers are responsible for and where their boundaries sit.</td><td><a href="/documentation/security/security/exchange-service-providers-esp-role.md">Exchange Service Providers (ESP Role)</a></td></tr><tr><td><strong>Infrastructure Boundaries</strong></td><td>What Husher's infrastructure deliberately does not include.</td><td><a href="/documentation/security/security/infrastructure-boundaries.md">Infrastructure Boundaries</a></td></tr><tr><td><strong>User Responsibilities</strong></td><td>The user-side behaviors that determine whether a swap is safe.</td><td><a href="/documentation/security/security/user-responsibilities.md">User Responsibilities</a></td></tr><tr><td><strong>Risk Disclosures</strong></td><td>External risks that the non-custodial model cannot eliminate.</td><td><a href="/documentation/security/security/risk-disclosures.md">Risk Disclosures</a></td></tr><tr><td><strong>Related Documentation</strong></td><td>Privacy model, failed transactions, FAQ, and support contacts.</td><td><a href="/documentation/security/security/related-documentation.md">Related Documentation</a></td></tr></tbody></table>