Wallet and security
Your SOL stays yours. This page explains how, step by step, and what AllenHark can and cannot do.
Only your server holds the key
Each bot gets its own wallet, created on your private server when the bot is set up. The private key is stored there and never leaves it: it is not sent to AllenHark and never shown in the web app. That's what "non-custodial" means here: AllenHark can't move your SOL.
What goes through the web is only what's needed to show and run the bot: balances, trades, settings. Commands from the web reach your server through the bot agent on it, and the agent only accepts the commands it allows. Sending money anywhere needs your PIN, checked on your server.
You can back up the key yourself from the terminal (Advanced, harkctl wallet export, PIN needed); see Terminal and harkctl. Importing an existing wallet also works only in the terminal. Private keys never go through the web.
Your PIN
You choose a PIN (4 to 8 digits) the first time you withdraw or go live. Your server asks for it:
- every time money leaves your wallet (withdrawals);
- when you add or remove a withdraw address;
- when you go live, or switch which wallet a bot trades from.
The PIN is checked and stored (hashed) on your server, never by AllenHark. Nobody at AllenHark will ever ask for it. You can change it in Wallet; changing it sends a security alert.
Withdrawing
Open Wallet, choose Withdraw, pick one of your saved addresses, enter the amount and your PIN. The SOL goes straight from your bot's wallet to that address. If the bot is running with open trades, the page warns you first, because the bot needs SOL to keep trading.
Saved withdraw addresses
You can only withdraw to an address you saved yourself. Adding one takes three steps:
- Your PIN. Enter the address, a name you'll recognise ("My Phantom") and your PIN.
- An email code. We email a code to your account's address. Enter it in the app. The code expires after 15 minutes; if it does, the address is removed and you start again.
- A 24-hour wait. The address becomes usable 24 hours after you confirm it. You get a Telegram alert (if connected) when it's added, and again when it's ready.
The first time, the app offers the address your deposit came from, so you can send SOL back where it came from.
Why the wait?
So that nobody can add an address behind your back and empty your wallet. If someone learns your PIN, they still need your email; if they have both, the 24 hours and the "new withdraw address" alert give you time to see it, change your PIN and remove the address before it can be used.
Experts can also manage a separate withdrawal allowlist from the terminal (harkctl withdraw-allowlist). Addresses added there are active at once, because only someone signed in to your server can add them.
What AllenHark staff can and cannot do
AllenHark staff can only reach your server when you allow it, with a support access grant. You grant it from the server's settings (Advanced) or with harkctl support grant, for as long as you choose (7 days from the app, up to 30 days from the terminal), and you can end it at any time. Managed plans keep it on so we can look after your bot each week.
| While you've granted support access, staff can | Staff can never |
|---|---|
| See your bots, their settings, trades and logs | See or export your private keys |
| Change and save strategy settings (each change is a version marked "support", which you can roll back) | Know or change your PIN |
| Start a bot, pause or resume buying, stop it and keep its tokens | Go live, or switch a bot to live trading |
| Turn launchpads on your plan on or off | Withdraw, add withdraw addresses, or move SOL anywhere |
| Run checks on the server | Buy or sell a token for you |
| Grant themselves access, or extend it |
Without a grant, staff can't reach your bots at all. Every command sent from the web or by support is logged, and every settings change is a version that says where it came from.
We never DM you first
AllenHark will never message you first on Telegram, Discord, X or anywhere else. We will never ask for your private key, seed phrase or PIN, and never ask you to send SOL. Anyone who does is a scammer, however official they look.
Our Telegram and Discord bots only send the alerts you turned on. They never ask you for anything, and you can't trade from them.
Official links
Only trust these:
- allenhark.com (the app is at allenhark.com/bots)
- Discord
- GitHub AllenHark-Inc
- Email: support@allenhark.com
Every link in our alerts starts with https://allenhark.com/bots.
Security alerts
Security alerts are always on while Telegram or Discord is connected: a new withdraw address, an address becoming usable or removed, every withdrawal, and a PIN change. Muting and quiet hours don't hold them back. Each one says what to do if it wasn't you. See Alerts on Telegram and Discord.