Security
Security that is built in, not bolted on
We design for the assumption that attackers will try. Here is how we protect your account, your data and your money.
Your account
Account protection
Strong authentication
Passwords of at least 12 characters, hashed with Argon2id. Optional authenticator-app 2FA for clients; mandatory for withdrawals and for all staff.
Sign-in monitoring
We record sign-in history, alert you to sign-ins from new devices, and lock accounts temporarily after repeated failed attempts.
Session control
Sessions use secure, HTTP-only cookies that expire automatically. Changing your password signs out other devices.
Your money
Financial controls
Double-entry ledger
Every movement is a balanced, append-only ledger transaction. The database itself rejects edits and deletions.
Verified payment events
Deposits are credited only after a cryptographically signed confirmation from the payment provider. Replays are ignored.
Withdrawal safeguards
Verified destinations only, 2FA on every request, daily limits, and manual review for higher-risk requests.
Our operations
Internal controls
Least privilege
Staff roles grant only the permissions each job requires. Staff cannot review their own accounts.
Audit trails
Administrative actions are logged with who, what, when and from where. Logs cannot be altered.
Encryption
Identity documents, wallet details and sensitive fields are encrypted at rest with AES-256-GCM.
Secure engineering
Strict input validation, CSRF protection, rate limiting, content-security policy and secure headers follow OWASP guidance.
Protect yourself
- We will never ask for your password, 2FA codes or wallet private keys — by email, phone or chat.
- Always check that you are on our genuine website before signing in.
- Enable two-factor authentication and store your recovery codes safely.
- Report anything suspicious to support immediately.
Ready to get started?
Open an account in minutes, secure it with two-factor authentication, and fund it with cryptocurrency when you are ready.