Yes, but for 100% security, user should follow the recommended procedure.When you select an «Automatic» subscription, the user leases a server with a root password. Access data are in our database, if user specifies it in his personal account panel. This solution is not very secure due to theoretically possible leaks. Do not specify withdrawal rights in API Key.
For complete security user should:
1. Change the server password (More information
here).
2. Specify in the personal account settings panel that the script should use an internal (located on a server) settings file.
3. Specify the Keys API in the server settings file (More information
here)