The most important safety question in automated trading has nothing to do with strategy. It's custody: who actually holds your capital? In a safe setup, the answer is always you.

The API model

Legitimate automation connects to your existing brokerage using API keys scoped to place trades but not to withdraw funds. The software submits orders; the money sits in your account the entire time, and you can revoke the keys or switch it off in seconds (your money, your keys). You never send your capital anywhere.

The red flag

If a product asks you to deposit money with them — into their "fund," "pool," or "managed account" — you've handed over custody and added a counterparty risk that has nothing to do with trading (managed vs non-custodial). This is the structure behind essentially every automated-trading horror story (scam red flags).

Not your keys, not your account, not your money. Automation should trade for you — never hold for you.

The standard

Demand non-custodial by default: your broker, your keys, trade-only permissions, and an off switch you control (the tool checklist). NoVo is non-custodial by design — it executes in your own broker account and never touches your funds, hosted or self-run (hosted vs self-hosted).