Your account protects your money and your personal data, so security is part of every feature rather than an extra. This page describes the nine controls that matter most and what you can do to strengthen them.
Sign-in can be protected by a second step using an authenticator app or a one-time code. We strongly recommend turning it on, and it is required before sensitive actions such as changing withdrawal details.
If you lose your second factor, recovery goes through identity verification with support, so nobody else can take it over by calling in.
Data is encrypted in transit between your device and our servers, and encrypted at rest in our storage systems. This covers account details, identity documents and activity history.
Access to that data is limited to the teams that need it for their role, and each access is logged.
We publish our official domains, and every genuine email can carry a personal security code that you choose. Anything without it, or sent from another domain, should be treated as suspect.
We will never ask for your password, a one-time code or your API secret by phone, email or chat.
A sign-in from a new device, a changed password or unusual activity triggers an email or push notification so you can react quickly.
If an alert is not you, change your password, end all sessions and contact support at once.
You can see every active session with its device and approximate location, and end any of them remotely. Sessions expire automatically after a period of inactivity.
Use this list after travelling or after signing in on a shared computer.
Recovery requires proof that you are the account holder: identity checks, answers only you should know, and contact through the details already on file.
This is deliberately firm. Limits can apply to withdrawals for a short period after a recovery.
Exchange keys can be limited to reading balances or to trading. Withdrawal permission is never required and should stay off.
Where the exchange supports it, restrict the key to our servers' addresses so a leaked key is useless elsewhere.
Sign-ins, connections, setting changes and strategy edits are recorded in a history you can review, with time and device.
If an entry looks unfamiliar, report it. The history is also what support uses to investigate.
Contact support by email or through your account manager if you suspect a breach. We can lock the account, end sessions and escalate to the security team.
You will be told what we are doing and what we need from you, and you will receive updates until the case is closed.
Security is built in layers, so that no single failure exposes your account. Network and application controls protect the servers, role-based access limits what staff can see, and monitoring looks for behaviour that does not fit. On the account side, the controls above give you your own layers: a second factor, a security code, device control and limited keys.
We test our own systems, review changes before release and keep an incident process that defines who decides, who communicates and how quickly. When something does go wrong, we would rather tell you early and plainly than hope it goes unnoticed.
The strongest controls still depend on a few habits. Use a password that exists nowhere else, ideally from a password manager. Keep your phone and email secure, because they are the route to recovery. Be suspicious of any message that creates urgency, offers a bonus for acting quickly or asks you to click a link to "verify" your account.
Check the address bar before you sign in, and bookmark the real site. Do not install software on the advice of a caller, even one who knows your name and your account details, because that information is often taken from earlier leaks.
Act first and investigate after. Change your password, end all sessions from the devices list, delete any exchange API key you created for the platform and then write to [email protected]. Our team will lock the account if needed, look at the audit history with you and explain what we found. Related reading: Fraud warning and KYC and AML policy.
Can anyone at the company see my password? No. Passwords are stored in a hashed form that staff cannot read back, and support will never ask for one. What happens if my phone is stolen? Sign in from another device, end the lost device's session and reset your second factor through support. Is my data stored in Canada? We aim to keep primary account data in Canadian or comparable jurisdictions, as described in the Privacy Policy.
Behind the account controls sit the measures that protect the service as a whole. Servers are hardened and patched on a regular schedule, administrative access is limited to named people and requires a second factor, and every privileged action leaves a trail that can be audited afterwards. Production data is separated from development and test environments, so that real client information is not used where it does not need to be.
Backups are encrypted and tested by restoring them, because a backup that has never been restored is only a hope. Changes to the platform go through review before release, and sensitive changes require a second person to approve them.
We work with a small number of suppliers for hosting, messaging and identity verification. Each is assessed before we use it, bound by contract to protect the data it handles and limited to what it needs. We keep the list short on purpose, because every additional supplier is an additional place where something can go wrong.
If you are a security researcher and you believe you have found a weakness, please write to [email protected] with the details. Give us a reasonable time to fix the issue before you publish, and do not access data that is not yours. We will acknowledge your report, keep you informed and credit your work if you would like that.
It helps to know how Canadian protection schemes apply, because they do not apply to everything.
Cash deposits with a member institution may be eligible for CDIC coverage, subject to its rules. Eligible securities held by a member investment dealer may be covered by CIPF, subject to its limits. Crypto and other digital assets are generally not covered by CDIC or CIPF.
In practice, treat crypto assets as unprotected by these schemes and size your allocation accordingly. More on this is in the Risk disclosure.