Delegated trading, without handing over the keys to the vault.

• Withdrawals are impossibleTandem refuses any API key that can transfer funds, and has no transfer code path at all.
• Keys never leave the serverEach key is sealed with its own AES-256-GCM data key; only the server can decrypt it.
• Everything is auditedEvery rule decision, order and permission change lands in an append-only, hash-chained log.