Security
How to keep your tandem account and your wallet safe, from your password and authenticator app to sessions and signatures.
Your money lives in your own Hyperliquid account, and only your wallet can move it. Your tandem account controls what tandem trades for you. Keep both safe.
tandem will never ask for your wallet's seed phrase (recovery phrase) or private key
Not by email, not in the app, not in a chat. Anyone who asks for them is trying to steal your money. Tandem also never asks you to send it money: deposits go from your wallet to your own Hyperliquid account.
Your sign-in
You can sign in with your email and password, or with Google or X where they are offered. Everyone uses the same sign-in form; with an authenticator app, a 6-digit code follows your password.
- Your email is confirmed. When you create an account, tandem emails you a link. Your account opens once you confirm the address. If nothing arrives, look in spam, or check the address.
- Choose a strong password that you don't use anywhere else.
You can see and change your ways in under Settings › You (your name at the top of the account menu).
Some accounts sign in only with their email, password and code. If Google or X says Use your email and password to sign in to this account., sign in on the form with those instead.
Forgot your password
Choose Forgot password?
On the sign-in page.
When your new password is set, every browser that was signed in is signed out. Sign in again with the new one.
Two-factor sign-in with an authenticator app
An authenticator app (such as Google Authenticator, 1Password or Authy) shows a new six-digit code every few seconds. With it, someone who learns your password still can't sign in.
To turn it on, open Settings › You, then Authenticator app, then Set up…:
Scan the QR code
Scan it with your authenticator app (or enter the key shown), then enter the code it shows.
Save your backup codes
Each one signs in once if you lose your phone, and they are not shown again. Use Copy or Download, then I saved them.
From then on, tandem asks for a code at each sign-in with your password.
Live trading needs an authenticator app
Turning on live trading asks for a fresh code from your authenticator. A code sent by email is not accepted for money actions.
To turn the authenticator off, choose Turn off… and enter a code from it. Tandem emails you when it is turned off.
Sessions and devices
Under Settings › You, Sessions shows every browser and phone where you are signed in, how each signed in, and when it was last used.
- Choose End next to one you don't recognise to sign it out.
- Choose Sign out everywhere to sign out every browser and phone, this one too.
When you sign in from a browser your account hasn't used before, tandem emails you "Was this you?". If it wasn't you, open the link and choose This wasn't me: that browser is signed out of your account at once. Then change your password.
What your wallet signs
When you turn on live trading, your wallet signs exactly two approvals:
- Tandem's trading key may place and cancel orders for 90 days. It can never withdraw or move money.
- Tandem's fee of 0.01% of each order (see Fees).
Later, you may also sign the removal of the trading key, or a move of your own USDC from spot to perps.
Read every request before you sign
If your wallet shows something else, such as a withdrawal, a transfer to another address, or a token approval, don't sign it.
Keeping your wallet safe
- Keep your seed phrase offline, written down, and never share it.
- Only connect your wallet on tandem's own site. Check the address in your browser before you sign.
- Use a wallet you only use for trading, holding only what you plan to trade.
- If you think your tandem account is at risk, Revoke live trading in Your wallet. It destroys the trading key at once. Then sign out everywhere and change your password.
- If you think your wallet is at risk, move your funds to a new wallet straight away. Tandem can't do this for you.
The trading key
Tandem's trading key for your account is made on tandem's server and kept encrypted. It is never shown to you, never sent to your browser, and never written to logs. It ends after 90 days unless you renew it, and it can't withdraw your money even if it were stolen.
Your data
Under Settings › You › Your data you can Export my data (what tandem keeps on you, as a file) or Delete my account.