Each validator has two sets of keys: a validator key and a withdrawal key. 

The withdrawal key is kept by yourself and has the power to withdraw ETH. If you lose the key, the staked ETH cannot be retrieved. And the withdrawal key is derived from the mnemonic, so please make sure to back up your mnemonic correctly (there is no need to back up the withdrawal key, just make sure your mnemonic is safe and sound).

The validator key is kept by InfStones, the staking service provider that imToken works with, and is used to sign attestations and propose blocks. If the validator is slashed because of some errors, then the loss will be shared between InfStones and the user.

Security is  the core of everything we do at imToken. InfStones is showing experience with a staking service of 100% up time and with zero security incidents, and has the technical expertise to minimize the risk of Slash.