Security of your account and data

1. Two-step authentication (2FA/MFA)

Two-step authentication adds a second barrier to sign-in: after your password, you confirm a code from an authenticator app. We support TOTP apps (time-based one-time passwords), and 2FA is mandatory for withdrawals and changes to payment details. Enabling it for sign-in is optional, but we recommend it from the day you register: it takes a minute and protects the parts of your account where money moves.

If you lose your device, recovery is handled with the support team through identity verification. Expect questions about your account's recent activity and presentation of documents; recovery is deliberately slower than normal access, because it has to be.

2. Data encryption

All traffic between your browser and the platform travels encrypted with TLS. Data at rest (identity documents, contact details, transaction logs) is encrypted at the storage layer of every system that holds it. Access to decrypted data is limited to the systems and roles that need it: compliance staff for verification documents, support for contact details, and nobody has full access to everything.

3. Fraud and phishing protection

Official messages from True Vestoworthen come only from our domains. We never ask for your password, your 2FA codes or remote access to your device. Messages about withdrawals or "account problems" that create urgency are the classic phishing pattern: pause and verify. If a message looks odd, forward it to [email protected] and we will confirm whether we sent it. The Fraud warning page lists the clone-company patterns we currently see.

4. Sign-in notifications

Every sign-in from a new device triggers an email with the device type, approximate location and time. If you receive one and it was not you, change your password immediately, review active sessions and contact support. Notifications about suspicious activity (for example, repeated failed password attempts) follow the same route.

5. Device and session management

The dashboard shows every active session: device, browser, IP address and last activity. You can close any session with one click, which ejects that device. Sessions expire after a period of inactivity and changing the password invalidates all other sessions. If you share a computer, sign out when finished: the session list is how you verify nothing was left open.

6. Account recovery

Password resets always require access to the registered email and identity confirmation for accounts with 2FA active. Recovery requests are handled by the support team, not an automatic process: a real person verifies that the requester is the owner. That makes recovery slower than a one-click reset, and it is intentional: a fast reset process is also a fast intrusion process.

7. API key permissions

Connecting an exchange account uses API keys you create at the exchange, with the permissions you choose. The platform needs read and trade permissions to function, but it never needs withdrawal permission: leave withdrawal disabled when creating the key. We store keys encrypted, with the minimum permissions necessary and masked after initial setup.

8. Audit log

Sign-ins, API connections, strategy starts and stops, configuration changes and payment-detail edits are recorded with time and IP. The log is available in your account dashboard, so you can verify that every listed action was yours. If you see something you did not do, the audit log is the starting point of the investigation: report it via the incident channel below.

9. Incident support

If you suspect unauthorised access, write to [email protected] with "URGENT" in the subject line. The account can be temporarily locked while the situation is reviewed. Expect an acknowledgement within the first working hour on business days, a person assigned to the case and updates in plain language as the review progresses. At the end you receive a summary of what happened and what was changed.