SQ-X00
ACCOUNT PRIVACY FILE
Baerx
A privacy-flow review of Baerx's presentation of account, trading, portfolio, API-permission and security-control surfaces.
- REVIEW DATE
- STATUS
- partially verified
- CONFIDENCE
- low
Written by SignalQuoin Editorial TeamIndependently reviewed by SignalQuoin Review TeamPublished by SignalQuoin Team
EDITORIAL ASSESSMENT
Baerx's conservative risk story can be positive for account security: the brief reports video KYC, 47 ms risk response, a 48-hour new-address delay and granular API permissions. The client-confirmed 0% maker/taker policy strengthens the commercial proposition but does not answer how the account and behavioural-data layer is funded or governed. Until the controller, processors, retention, automated-decision rules and appeal route are documented, security confidence must not be mistaken for privacy proof.
- Granular API permissions and a 48-hour address delay are explicitly described
- Risk and support timings create measurable accountability checkpoints
- Strict KYC is described with enough detail to request purpose, retention and appeal records
- The legal controller, biometric/KYC vendors, transfer safeguards and retention schedule are not supplied
- No SignalQuoin account, network capture, API-permission or rights-request observation has been performed
- The claimed 1,200-review corpus lacks URLs, consent/provenance and deduplication method
CLAIM → EVIDENCE → LIMIT / 5
The privacy ledger
Account, video KYC and identity boundary
- CLAIM UNDER REVIEW
- The brief reports typical KYC review of 20–40 minutes, video capture and occasional two-hour cases.
- EVIDENCE FOUND
- The commissioned material makes strict identity verification part of the safety proposition.
- DO NOT INFER
- It does not identify controller, biometric processor, liveness method, retention, human-review boundary, automated-decision appeal or cross-border transfer.
- VERIFICATION PLANNED
- Collect the controller, KYC vendor list, purposes, retention, transfer safeguards and appeal route before any real identity submission.
API permission boundary
- CLAIM UNDER REVIEW
- Baerx reports REST and WebSocket APIs with granular permissions and access controls.
- EVIDENCE FOUND
- The provider homepage makes API connectivity and permission control part of its professional proposition.
- DO NOT INFER
- A provider description does not establish actual scopes, defaults, token storage, request logging, revocation speed, rate limits or isolation between trading and withdrawal authority.
- VERIFICATION PLANNED
- Obtain versioned API documentation, then inspect an unfunded key's default scopes, least-privilege options, revocation, IP controls and request logs without placing an order.
Behavioural risk and withdrawal boundary
- CLAIM UNDER REVIEW
- The brief reports 47 ms average risk response, a 48-hour withdrawal-whitelist delay and manual review of one 62 ETH request.
- EVIDENCE FOUND
- These figures imply behavioural, device, location, beneficiary and transaction-risk processing.
- DO NOT INFER
- No feature list explains which signals are used, whether decisions are solely automated, how long they persist, who receives alerts or how a user contests a false positive.
- VERIFICATION PLANNED
- Request the risk-data categories, legal basis, retention, human review and appeal process; test only synthetic/no-value events.
Support, review corpus and privileged access
- CLAIM UNDER REVIEW
- The brief reports a 25-minute response on a held withdrawal and sentiment analysis over 1,200 public comments.
- EVIDENCE FOUND
- Both claims concern personal or pseudonymous communications and moderation data.
- DO NOT INFER
- The processor roles, case-access logs, corpus URLs, deduplication, bot filtering and lawful reuse are not supplied.
- VERIFICATION PLANNED
- Review support access and corpus provenance, then run a non-sensitive rights request that records identity checks, handoffs, export and deletion limits.
Compliance, scale and observation plan
- CLAIM UNDER REVIEW
- Baerx publishes compliance, availability, user-scale and trading-volume statements alongside its professional positioning.
- EVIDENCE FOUND
- The official homepage is the source of those published figures and assurances.
- DO NOT INFER
- These statements are sourced to the provider page and must not be converted into a licence finding, audit result, security guarantee or measured service level.
- VERIFICATION PLANNED
- Gate the sequence on entity, privacy, authorisation and assurance documents; then run unfunded network capture and permission checks before any separately approved low-value order or withdrawal scenario.
EXPERT PRIVACY REVIEW / 8 FLOWS
From identity edge to revision trigger.
Baerx's own public presentation of account, trading, portfolio, API-permission, support and security surfaces. The sole source is batrx.io; contracting, privacy-notice, operator and observation records are verification gates for this file.
Technically confident readers evaluating a professional account and API workflow who will require a named operator, applicable privacy terms and observable permission behaviour before relying on the platform.
Privacy-sensitive users who need a verified controller, market-specific terms, documented rights and a tested least-privilege API path before providing identity or account data.
Granular API permissions and a 48-hour address delay are explicitly described
Coinbase, Kraken, Crypto.com or Binance provide more directly addressable entity and privacy evidence today; Baerx remains a promising interface candidate if its document and observation gates are satisfied.
IDENTITY / AUTHORITY BOUNDARY
The professional account proposition implies identity, account, trading and API data flows, but controller, legal basis, recipients and retention are verification gates.
- 01
Request operator, privacy, KYC, retention and API-permission documents first; only then use a synthetic pre-account enquiry and no-funds read-only observation before any value-bearing action.
- 02
Documentation request: Public contact → controller/KYC/API/privacy questions → response
- 03
Read-only permission: Verified documents → no-funds account → read-only API key → revoke
- 04
Alternative path: Coinbase, Kraken, Crypto.com or Binance provide more directly addressable entity and privacy evidence today; Baerx remains a promising interface candidate if its document and observation gates are satisfied.
| FLOW QUESTION | BOUNDED FINDING | PROOF STATE | VERIFICATION PLANNED |
|---|---|---|---|
| Who controls video KYC? | The brief reports video verification and 20–40 minute typical review, but controller, biometric/liveness fields, vendor chain, automated decision and retention are gates. | VERIFICATION PLANNED | Obtain controller, legal basis, KYC vendors, transfer safeguards, retention and appeal route before onboarding. |
| Where do account and custody data meet? | Portfolio, deposit and withdrawal presentation suggests a hosted account, while custody and ledger data boundaries remain verification gates. | VERIFICATION PLANNED | Obtain custody and account-record terms before any minimal-value route. |
| What usage data is collected? | The public professional interface does not itself establish analytics, device, IP, cookie or behavioural-event handling. | VERIFICATION PLANNED | Observe the public surface and then an authorised no-funds account with synthetic identifiers. |
| How granular are API rights? | Granular API-permission and REST/WebSocket claims are attractive, but scope defaults, withdrawal separation, logs, IP restrictions and revocation remain verification gates. | VERIFICATION PLANNED | Test read-only scopes, revocation and event logs without funds after documentation review. |
| What data drives 47 ms risk decisions? | The reported risk response and 48-hour whitelist imply device, location, behaviour, beneficiary and transaction signals; fields and human-review boundary are not supplied. | VERIFICATION PLANNED | Request signal categories, retention, recipients, false-positive review and appeal; use synthetic events only. |
| Does 200+ countries prove lawful data processing? | No. The reach claim is sourced to the provider page and does not identify market availability, controller establishments, transfer safeguards or regulator permissions. | VERIFICATION PLANNED | Build a country-by-country operator, eligibility and data-transfer matrix. |
| Who can access the held-withdrawal case? | A 25-minute response is reported, but authentication, role access, vendor location, transcript retention and complaint rights are not documented. | VERIFICATION PLANNED | Send a non-sensitive request and record identity checks, handoffs, access/export and escalation. |
| Can the 1,200-comment corpus be reproduced? | The brief reports sentiment from Reddit, Trustpilot and three forums; URLs, date window, deduplication, bot filtering and reuse basis are not supplied. | VERIFICATION PLANNED | Require a redacted corpus manifest and method; do not derive a privacy or trust score from an opaque sample. |
| SCENARIO | SEQUENCE | DATA DISCLOSED | OPEN QUESTION |
|---|---|---|---|
| Documentation request | Public contact → controller/KYC/API/privacy questions → response | Only synthetic contact information deliberately supplied for the request. | Which legal entity, recipients, retention and rights channel are named? |
| Read-only permission | Verified documents → no-funds account → read-only API key → revoke | Account identity, key metadata, IP/device and read events depending on implementation. | Are scopes least-privilege, withdrawals separate, events exportable and revocation immediate? |
Keep every homepage statement attributed to the provider. Do not infer data minimisation from visual design or security language. Obtain controller and privacy records, then observe with synthetic data and least privilege.
Adequate to map the reported video-KYC, risk, whitelist, API and support data surfaces; controller, vendors, biometric handling, telemetry, sharing, retention, appeal and rights execution require further evidence.
- A verifiable privacy/controller and operator package is supplied.
- Versioned API and security documentation identifies scopes, logs and recipients.
- Controlled no-funds observations establish actual endpoint and support behaviour.
CHANGE / REVISION TRAIL
Added video-KYC, 47 ms risk, 48-hour whitelist, support-case and 1,200-comment data-flow questions.
Opened the exchange privacy-flow file.
A verifiable privacy/controller and operator package is supplied.
DECISION FAQ
Does strict KYC prove good privacy?
No. It may support compliance and account security while increasing biometric, identity and retention risk.
Does the 48-hour whitelist reduce data collection?
No. It is a security control; the risk signals and retention still need disclosure.
Has SignalQuoin opened an account or API key?
No. Documentation gates precede all onboarding and observation.
What would change this privacy conclusion?
A verifiable privacy/controller and operator package is supplied. Versioned API and security documentation identifies scopes, logs and recipients. Controlled no-funds observations establish actual endpoint and support behaviour.
PRIMARY SOURCE REGISTER
1 records
Source access and applicable scope were recorded on 16 August 2026; records are attributed by class.- productBaerx official homepage — platform presentation ↗Retrieved 2026-08-16