Security on the platform

1. Two-factor authentication

Two-factor authentication (2FA) adds a second proof, a single-use code from an authenticator app, to your password at sign-in and before sensitive actions such as payment-detail changes. With 2FA on, a stolen password alone is not enough to reach your account, which defeats the most common attack on any online service: credential replay from an unrelated leak.

Setup takes two minutes from the security settings, and we recommend doing it on your first day rather than your first scare. Use an authenticator app rather than SMS where you can: app codes are not subject to SIM-swap interference. Recovery codes are generated at setup; store them offline, because they are the path back in if you lose your phone.

2. Encryption of data in transit and at rest

Every connection to the platform travels over TLS, so traffic between your browser and our systems cannot be read or altered in transit. Data at rest, the records that identify you and your preferences, is stored encrypted, and access to those stores is limited to the systems and staff that need it for the jobs described in the Privacy Policy.

Passwords are never stored at all: only irreversible hashes, from which your password cannot be reconstructed. The same principle applies to the keys used for exchange connections, which are kept encrypted and are never displayed in full after entry. If you ask support what your password is, the honest answer is that nobody, including us, can read it.

3. Anti-fraud controls

The payments layer applies checks designed to catch fraud before money moves: destination accounts must match your verified identity, deposit sources in your own name are the only ones credited, and withdrawals to new destinations receive additional review. Pattern checks flag unusual timing, sizing and device fingerprints, and a human looks at anything that trips them.

On the human side we run the controls most clone firms skip: we never cold-call, never request your password, one-time codes or remote access, and never ask you to move funds to a "safe account". The full list of warning signs and the reporting route, including Action Fraud, are on the fraud warning page.

4. Login alerts

Whenever your account signs in from an unrecognised device, you receive an immediate email naming the device type, time and approximate location. The alert exists because early detection is everything: a sign-in you recognise as yours costs a moment of attention, while a sign-in you do not recognise is your cue to change the password and contact support within minutes.

Alerts are informational, not a permission request: they arrive after the event and require no action when the login was yours. If an alert names a login that was not you, the fastest sequence is to change your password, then write to [email protected] so all sessions can be force-closed while we look at the audit trail together.

5. Session control

Sessions expire after a period of inactivity, and you can review and end every active session yourself from the security settings, including sessions on devices you no longer own. Changing your password invalidates all other sessions automatically. Together with login alerts, this means a forgotten sign-in on a shared or sold computer is a two-click problem rather than an open door.

For sensitive pages, payment details and withdrawals, the platform re-challenges you rather than relying on a long-lived login. That is why a withdrawal asks for a fresh single-use code even when you have just been using the dashboard. The small friction is deliberate: it prices the action at its actual risk.

6. Account recovery

Losing access to your email or phone should not mean losing your account. Recovery runs through a verified process: identity re-confirmation against the documents held from your original verification, a cooling-off period on any contact-detail change, and a written record of every step. The cooling-off matters because account takeover usually begins by changing the contact details first.

If you change your email address or phone number, expect the platform to keep notifying the old address for a grace period and to require confirmation from both. It is a deliberate inconvenience. If someone contacts you claiming the process can be shortened for urgency, that person is not us; genuine recovery has no shortcuts to sell.

7. Exchange connection scopes

The platform reads market data through exchange keys that you create yourself, in your own exchange account, with read-only permissions selected by you. A read-only key can view prices and, where applicable, balances; it cannot place orders, and it cannot withdraw. The scope is visible on your exchange's own key-management page at any time, and you can revoke the key there instantly, without asking us.

When your adviser walks you through the connection on the setup call, they will name each permission as it is ticked, and encourage you to leave withdrawal rights unticked. This is the design decision that most sharply limits blast radius: even a fully compromised platform key cannot move your funds, because the key never carries that power.

8. Audit history

Every meaningful action on your account, sign-ins, preference changes, payment-detail updates, withdrawal requests, plan changes, is logged with timestamp, device and outcome. The log is visible to you in the dashboard, not just to us, so you can audit your own account's story without filing a request.

The audit history has two jobs. In the benign case it answers ordinary questions, such as exactly when a withdrawal was released or which device a login came from. In the adverse case it is the evidence trail that an investigation, or a complaint under the process on our complaints page, can rely on. Logs are retained under the schedule in the Privacy Policy and are protected from alteration.

9. Incident support

If something goes wrong, a security incident, a suspected takeover, a payment that looks wrong, one message to [email protected] routes it to the incident process: containment first, including freezing affected activity, then investigation with the audit log, then a plain-language account of what happened and what changed. Security incidents are prioritised above every other queue.

Support will never ask you for secrets during an incident. The strongest habit is the one this page keeps repeating: passwords and one-time codes are yours alone, and any message, call or "agent" asking for them is an attack by definition, whatever else it gets right. Verify through the published channels, then act.