Security you can check, not just believe

1. Two-factor authentication

Two-factor authentication (2FA) and multi-factor authentication (MFA) are supported on every account and can be enabled in minutes from your security settings. We support authenticator applications that generate time-based one-time codes, which keeps the second factor on a device you physically hold rather than in a message that could be intercepted. Enabling 2FA is strongly recommended for all clients and is presented as part of onboarding rather than buried in a settings menu, because it remains the single most effective protection against account takeover.

During setup you receive a set of backup codes. Store them offline, separated from your primary device: if you lose your phone, a backup code restores your access in minutes. Recovery without 2FA possession requires full identity verification through support, deliberately slower because that friction belongs to an attacker, not to you.

2FA protects the login, not the phone call you choose to trust. Never read a one-time code aloud to anyone, including someone claiming to be from our team; our staff will never ask for one.

2. Encryption of data

Data is encrypted in two states. In transit, connections between your browser or the mobile app and our systems are protected with current industry transport encryption, so credentials and personal information cannot be read while crossing networks. At rest, stored records such as identity documents and account details are encrypted within the storage systems that hold them, and those systems sit behind access controls that limit which services and roles can reach which data.

Encryption is applied by the responsible systems as a default rather than an option, meaning there is no configuration in which your documents are stored in plain readable form in the primary stores. The scope covers the account database, document storage and backup media. Decryption keys are themselves access-controlled, and routine operational access to decrypted personal data is limited to verification and support staff who need it to do their jobs.

3. Fraud and phishing protection

Impersonation is the most common attack on clients of financial platforms, so we publish the rules plainly. Official communication comes only from our genuine domain and the support address published on this site. We do not ask for passwords, one-time codes or full payment credentials by email, phone or chat, ever. Where a message needs to prove it is genuinely ours, the protective code word you set with your manager is the mechanism: a caller who does not know it is not us, and the conversation ends there.

Treat any unexpected message that creates urgency, offers a bonus for immediate action, or directs you to a login page through a link with suspicion, even if it looks right. Clone sites copy design well and cannot copy the address bar. Bookmark the official login page, compare domains character by character, and when in doubt contact support through the address on this page before acting.

4. Login notifications

Every sign-in from a new device, and any sign-in assessed as unusual for location or timing, triggers an immediate notification to your registered email and, where enabled, a push alert. The notification tells you the device type, the approximate location and the time, so you can recognise your own actions and spot the ones that are not yours in seconds rather than weeks.

If a login you do not recognise appears, use the notification to jump straight to session management and sign the device out, then change your password if there is any doubt. Suspicious-activity alerts, such as a password change you did not make or a withdrawal to unfamiliar details, are treated as security events: the account can be temporarily frozen while verification is completed, which is an inconvenience measured in minutes against a loss measured in years.

5. Managing devices and sessions

The security settings page lists your active sessions: each device that is currently signed in, when it last connected, and from roughly where. You can end any session individually or sign everything out at once, which is the right move after losing a device, lending a laptop, or noticing activity you cannot explain. Revoking a session takes effect immediately on our side, and the affected device must re-authenticate to return.

Sessions also expire automatically after a period of inactivity, and Trusted-device lists let you keep daily hardware convenient without leaving stale logins alive indefinitely. The combination is deliberate: convenience for the two or three devices you actually use, and short leashes for everything else. We recommend reviewing the session list whenever a device leaves your possession permanently.

6. Account recovery

Recovering an account is intentionally harder than using one. When you cannot sign in, recovery begins with verified identity: the email or phone on record, followed by identity-document checks against the records from your original verification. A support specialist, reachable at our published address, guides the process and confirms outcomes in writing to the address on file.

There are limits designed to protect you: recovery cannot be completed to new contact details without document verification, cannot skip the waiting period on high-value withdrawal rules, and cannot be performed on the basis of information an attacker could obtain from your mail or social profiles alone. These frictions exist because a recovery process that is easy for everyone is easy for an attacker too; a genuine owner finds them a few extra minutes, a criminal finds them a wall.

7. API key permissions

Where the platform's automation connects to external venues on your behalf, it does so through interface keys issued with the narrowest permissions that suffice for their function. The permission classes are separated into reading account and market data, executing trades, and moving funds. By policy, keys used for trading never carry withdrawal rights, and keys used for reporting never carry execution rights, so a single compromised key can never do everything.

Keys can be reviewed from your security settings: which exist, what each may do, and when it was created or last used. A key that should not exist can be revoked immediately. Clients who integrate their own tooling are asked to follow the same discipline of least privilege, and our support team will review any key configuration you are unsure about before you rely on it.

8. Audit history

Your account keeps an audit trail of the events that matter: logins and their devices, connections and disconnections of services, changes to strategies and their settings, and modifications to security options such as passwords and 2FA. Entries are timestamped and retained so that a question months later can still be answered from the record rather than from memory.

The audit view exists for you, not only for us. Scanning it occasionally turns "something felt odd last week" into a specific event with a date and a device, which is exactly what support needs to act quickly. If an entry in your history is not yours, that is a security event, and treating it as one is the correct response.

9. Support during incidents

When something goes wrong, the path is short. Security concerns go to our published support address with an urgent marking and are handled ahead of the normal queue. The first step for suspected unauthorised access is an account lock, applied within minutes of a credible report, followed by verification of your identity and a joint review of the audit trail to establish what happened.

Communication during an incident follows a set order: confirmation that the report was received, the protective actions already taken, what we find as the review proceeds, and the concrete steps to restore normal use. We do not mark security matters resolved silently. If an incident involves data that may have been exposed, affected clients are told plainly what category of information was involved and what to do about it, because a client who learns of a problem from us can act on it before anyone can exploit it.