How your account is protected

Your password alone should never be enough to open your account, so sign-in from a new device asks for a second factor from an authenticator app on your phone. We support any time-based one-time password app, including the ones built into modern phones, and recovery codes are generated when you enable the feature.

Two-factor authentication is strongly recommended for every account and is switched on with your manager during your first call, which takes about three minutes in total. If you lose your device, account recovery is performed through identity verification with the support team; it is deliberately slower than a normal sign-in, because it should be.

Data is protected in transit and at rest. Everything you exchange with the platform travels over TLS, the standard encrypted web channel, and personal records stored by our systems are encrypted on disk within access-controlled infrastructure. The systems handling identity documents and payment details apply encryption as part of their baseline configuration rather than as an optional extra.

Responsibility is divided: the platform's own systems are managed by our engineering and security teams, while the exchange and payment providers that process execution and card transactions maintain the encryption standards of their own regulated environments.

Official communication comes only from our own domain, and we never ask for your password or a one-time code by email or phone. As an additional safeguard, you can set a personal security phrase with your manager: any legitimate call from us will confirm it before discussing your account, which quietly defeats most impersonation attempts.

Messages that rush you, offer unusually favourable terms or point at lookalike addresses are the classic pattern of phishing. When anything feels off, do not click; write to [email protected] and let the team verify it. The fraud warning page describes the clone-firm problem in more detail.

You receive an email whenever your account is signed into from a device it has not seen before, and a notification whenever activity looks unusual, such as a password change, a new withdrawal method or a sign-in from a new country. The alerts tell you the device type, the approximate location and the time, so you can recognise your own actions and question anyone else's.

If an alert does not match something you did, follow the secure link in it to lock the account and change your password, then contact support. Minutes matter, and we treat such reports with priority.

One habit multiplies the value of these notifications: keep access to the email address on your account secure and current. A stale mailbox you no longer check is the quietest way to miss an alert that mattered, so if you change email providers, tell your manager before, not after.

The security settings page lists every active session on your account, with device type and last activity, and you can revoke any of them yourself with one click, no support ticket required. Signing out on a lost laptop is therefore a thirty-second job you can do from your phone.

Sessions expire automatically after a period of inactivity, and a suspended account keeps its audit trail intact for any later review. We recommend a quarterly habit of glancing at the session list the way you might check a bank statement.

Recovering access after a lost device or forgotten password always involves verifying your identity, never a simple email loop. The support team will match you against the identity documents provided during verification, confirm your security phrase and, where warranted, arrange a short video confirmation. Only then is access restored and previous sessions terminated.

These steps exist to protect you from someone else pretending to be you. Recovery is normally completed within one working day, and the moment a request is approved all old sessions and keys are revoked.

After any recovery, take ten minutes to review the audit history together with support: every action taken between the incident and the recovery is listed, so nothing that happened in the gap stays a mystery to you.

Connections to exchanges use keys with the narrowest permissions that allow the work: reading market data and placing orders. The permission to withdraw funds is never granted to platform keys, so no one, including the platform itself, can move assets off an exchange through a trading key.

When you review a strategy or a connection, the permission level of each key is displayed beside it. If a key is ever shown with rights it should not have, revoke it immediately and tell support; the platform re-issues keys with correct permissions.

Every material event on your account is recorded: sign-ins and sign-outs, new devices, password and two-factor changes, strategy activations and adjustments, connection changes and withdrawal requests, each with a timestamp. The history is available to you in the platform and to support during investigations.

This record serves two purposes. For you, it is a monthly statement of everything that happened. For us, it makes disputes resolvable on facts rather than memories, and any inconsistent change can be traced and reversed where necessary.

The history cannot be edited by anyone, including support staff; entries are appended, never rewritten. If you ever dispute what happened on your account, you and the complaints team will be looking at the same immutable list.

If you suspect unauthorised access, write to [email protected] or call during support hours and say so in the first sentence. The first action is to freeze the account, stopping trades and withdrawals while the situation is established; a second team member then walks you through securing your email, reviewing the audit trail and issuing new credentials.

Security reports are handled by a dedicated escalation path with the aim of first contact within the hour during support hours. You will receive a summary of what happened and what changed as a result, in plain English.