Security

1. Two-factor authentication

Two-factor authentication (2FA) can be enabled on every account and we encourage enabling it on the day you register. With 2FA active, signing in from an unrecognised device requires a single-use code generated on your device in addition to your password. Sensitive actions, including changes to your withdrawal details, request a second factor even on recognised devices.

Codes are time-based and single-use, so a code that has been read by someone else expires within seconds. Recovery of a lost 2FA device is a deliberate, manual process: identity documents plus a call with our team. That friction is intentional; convenience is the enemy of account recovery security.

2. Encryption of data in transit and at rest

All traffic between your browser and the platform travels over TLS, and HTTP requests are redirected to HTTPS. Data at rest, including your account record and verification documents, is stored encrypted. Passwords are never stored in a usable form: they are hashed with a deliberately slow algorithm, so even a full copy of the database would not reveal your password.

Encryption keys and decryption paths are separated from the application servers, and access to the document store is limited to the compliance roles that need it for verification. Every read of a stored identity document is itself logged, so a human looking at your ID leaves the same audit trail as a machine.

Encryption is a floor, not the whole house. It protects data that is copied or intercepted; the measures around access control exist so that interception is not the only line of defence.

3. Anti-fraud controls

Payments are screened against patterns typical of card fraud and account takeover: mismatched geographies, rapid changes of device, unusual withdrawal timing after credential changes. Withdrawal destination changes trigger a waiting period and a confirmation to your registered email before they take effect. These controls occasionally delay a legitimate action; we accept that cost, and a quick email to support resolves genuine cases.

We also monitor for impersonation of our brand: clone domains and fake support numbers are reported and taken down where possible, and the fraud warning page lists the patterns currently in circulation.

4. Login alerts and notifications

Every sign-in from a new device or browser generates an immediate notification to your registered email address, including the approximate location and device type. Changes to your email address, password or phone number trigger the same. If you receive an alert you did not cause, it means someone has your password; change it immediately and enable 2FA if you have not.

Alerts are deliberately plain-text and never contain links that ask you to re-enter credentials. That design removes the most common phishing angle: an attacker cannot convincingly imitate a notification that never links to a login form.

Withdrawal requests generate their own notification with the amount and destination, so a fraudulent request cannot proceed quietly in the background while you are unaware. Confirming or querying one is a single reply away.

5. Session management

Sessions expire after a period of inactivity, and you can review and terminate all active sessions from your account settings. Signing out on one device does not silently leave others signed in; the session list makes them visible and revocable. Administrative sessions inside the company are separate, shorter-lived and require re-authentication for sensitive operations.

Session tokens are bound to the device that created them, which is why a token stolen from one browser fails when replayed from another. A password change invalidates all existing sessions at once, closing an intruder's access in the same step that locks the front door behind you.

If you use a shared or public computer, sign out explicitly. A closed tab is not a signed-out session.

6. Account recovery

Recovering access after a lost device or forgotten password requires control of your registered email plus, where 2FA was enabled, a documented identity check with our team. Recovery is never granted on the strength of a phone call alone, and we will never ask you to read out a password or a current 2FA code. The process is designed so that an attacker who knows everything public about you still cannot take your account.

7. Exchange connections and permissions

Connections between the platform and your exchange account are created with read-only API keys. A read-only key can view market information and balances but cannot place orders, initiate withdrawals or change settings. We never request withdrawal-enabled keys, and you should treat any service that does, whatever it claims to be, with suspicion.

Keys you create are stored encrypted and are shown only once, at creation, on the exchange's own interface. You can revoke a connection at any time from your exchange's API settings, which takes effect immediately without contacting us. Revoked keys are purged from our store on the next sync, and the audit history records both the connection and the revocation.

When you travel, connections keep working but sign-ins from a new country can trigger an extra verification step. That is deliberate: a holiday should not lock you out, and neither should a fraudster's plane ticket let someone in.

8. Audit history

Every meaningful action on your account, including sign-ins, settings changes, plan changes, deposits, withdrawals and exchange connections, is recorded with a timestamp, the device involved and the action's outcome. This audit history is visible to you in the dashboard and forms the factual basis for any complaint investigation.

Entries cannot be edited or deleted by anyone, including our staff, and the record you see is the same record compliance sees when investigating a dispute. In a disagreement about what happened, the audit history is the version that counts.

Internally, the same record covers staff actions on accounts, reviewed quarterly. An action that cannot be attributed to a person or a system event does not exist in our operational model.

9. Incident support

If you suspect your account is compromised, write to [email protected] with the word "Urgent" in the subject line, or ask your account manager to escalate immediately. We can freeze withdrawals and force a password reset within minutes of confirming a report. After any incident, we provide a written timeline of what happened to the account, based on the audit record, and what we have changed in response.

Reported incidents feed a monthly review of patterns: if one fraud shape keeps appearing in user reports, controls change to close it, and the fraud warning page is updated so the next user recognises it before losing anything.

Security is a shared boundary. Our nine layers stop most attacks; a unique password, 2FA and scepticism toward unexpected messages stop the ones that target you personally.