Why Coil can’t touch your money
Not a policy, and not a promise — an architecture. The code to move money does not exist in Coil, and this page walks the mechanisms that make that true, each with the file that enforces it.
The claim, precisely
“Can’t touch your money” means exactly this: no deposit, no vault, no withdraw button. There is no Coil account to fund, no balance held with us, and no code path in the software that can move funds in any direction. Your capital sits where it already sits — in your own brokerage account, in your name, at your broker.
What this page does NOT say: that you can’t lose money. Coil trades leveraged ETFs at reduced size, and those can lose value rapidly, including total loss of the capital you commit. Stops are enforced by the engine on each cycle it runs — not resting at your broker — so positions are unprotected between cycles and overnight, and a gap can move straight through a stop price. Custody risk and market risk are different things. This page is about the first. The second is fully yours, and no tool removes it.
Where the authority actually lives
Coil is a relay with one direction of authority, and the software is deliberately the party with the least of it:
| Party | Holds | Can do |
|---|---|---|
| The engine (Coil) | Rules and scores. No credentials, no connection | Print an order as text. That is the entire list |
| Your AI agent | The broker connection, on your machine | Read the printout and place it — buy and sell equities only, in one allowlisted account |
| Your broker | Your money, your positions, the real off switch | Execute orders; revoke the agent’s access entirely, from their side |
When the engine wants to buy, the most it can do is print a line like this into its plan:
place_equity_order(buy NVDA, $52 notional, market, <your account>) [new, stop 168.40]That line is text. Nothing in Coil can execute it — the engine has no broker connection to send it over. Your agent reads it, checks it against the rules it was installed with, and places it through your broker’s own interface. Unplug the agent and the printout is just a printout.
The receipts
Six mechanical facts, each with the place in the shipped code that makes it true. Can’t here always means the code does not exist — never “we pinky-promise not to.”
| Fact | Mechanism | Where |
|---|---|---|
| No order-placement code | The engine’s only relationship to place_equity_order is printing it inside its plan text. There are no broker-API call sites in the engine | coil_v4/engine.py (the printout lines) |
| No money-movement code | No transfer, withdrawal, wire, or ACH function anywhere — not disabled, not gated: absent. The funding module only detects deposits you make yourself, to keep the risk math honest | coil_v4/funding.py |
| No broker credentials | You authorize your agent at your broker’s own site via OAuth — your password is never typed into Coil or your agent. The only secret Coil stores is a free market-data key | docs/CONNECT_YOUR_BROKER.md, .secrets/alpaca.json |
| One account, ever | An allowlist that restricts rather than empowers: the safety core names the single account, commented “the ONLY account that may EVER be traded.” Any other account is hard-refused | coil_v2/safety_core.py |
| Long-only, hard-coded | LONG_ONLY = True — shorts, inverse ETFs, and margin are refused in code, on every strategy profile | coil_v4/config.py |
| Tamper-evident safety core | The safety module is SHA-256 fingerprinted; the engine self-checks the hash and halts on mismatch, and your agent is instructed to stop and tell you rather than re-approve it | coil_v2/exec/safety.py |
Arming is a ceremony, on purpose
Coil ships with live trading OFF. Turning it on is a deliberately manual flow that your agent is instructed to refuse to do for you: you allowlist your one account, re-pin the safety fingerprint, run the self-test suite, and type a total-loss acknowledgment yourself. Scheduling the routines is never arming — a scheduled Coil that you never armed watches and reports, and places nothing.
Three off switches, strongest first
1 — At your broker. Revoke the agent’s access from your brokerage’s own connected-apps controls. This withdraws the authority itself: no software on your machine can override it, and it is the switch we’d point you to in a hurry.
2 — In Coil. Tell your agent “stop”: it sets the kill switch (LIVE_TRADING = False — in the code’s own words, “the ONLY thing that arms real orders”). The engine keeps planning and places nothing. Stopping never sells what you hold — open positions stay yours to manage, at your broker, where they always were.
3 — In your agent. Remove the broker connector from its configuration. The hands are gone; the printout is just a printout again.
Check, don’t trust
The engine is readable Python that ships in the download — grep it yourself: search the code for a transfer or withdrawal function and find none; search for where place_equity_order appears and find printout strings. And the part that can’t be checked by reading — whether the rules are worth running — has its own page: the live engine record publishes the real account against SPY and QQQ every session, win or lose, with an append-only SHA-256 commitment log so yesterday’s claims can’t be quietly rewritten.
See the Trading Bot → Straight answers in the FAQ
Coil is trading software you install and operate yourself. It is not investment advice, not a managed account, and no result is guaranteed. Leveraged ETFs can lose value rapidly, including total loss. Coil is independent and is not affiliated with or endorsed by Robinhood or any brokerage.