We operate under a strict multi-layer security framework — from segregated accounts to institutional-grade encryption — so your capital is always safe.
Six interlocking layers of protection keep your capital and data safe.
All client funds are held in segregated accounts at licensed banking institutions — completely separate from our operational capital. In any insolvency scenario, client funds cannot be used to meet company obligations.
All data in transit is protected by TLS 1.3. Data at rest is encrypted using AES-256. Private keys and sensitive credentials are stored in hardware security modules (HSMs) — never in plain text.
Mandatory identity verification for all clients. Our AML engine monitors transactions in real-time using FATF-recommended risk scoring and flags suspicious patterns for manual review by our compliance team.
All accounts are protected by 2FA (TOTP / SMS). Withdrawals require a secondary transaction PIN. Suspicious logins trigger device verification before access is granted.
Our security operations centre monitors platform activity around the clock. Intrusion detection, rate limiting, DDoS mitigation, and automated anomaly alerts ensure rapid response to any threat.
We commission independent penetration tests quarterly and annual SOC 2 Type II audits. Findings are remediated within strict SLAs. Audit reports are available to institutional clients on request.
We operate under the oversight of recognised financial regulators, adhering to the highest standards of client asset protection, capital adequacy, and conduct.
View Our LicencesEvery withdrawal request passes through multiple checkpoints before funds are released.
A unique 4-digit PIN — separate from your login password — must be entered to authorise any withdrawal.
Only pre-approved withdrawal addresses saved to your account can receive funds. New addresses require email confirmation.
Withdrawals to new addresses are held for a 24-hour review window, giving you time to cancel if access is compromised.
Our automated AML engine screens every withdrawal against sanction lists and behavioural patterns before processing.
Withdrawals above threshold amounts are subject to manual review by our compliance team before release.
In the unlikely event of a security incident, our response is fast, structured, and transparent.
Automated systems and our security team identify anomalies within minutes of occurrence.
Affected systems are isolated immediately to prevent lateral spread or further data exposure.
Affected clients are notified within 72 hours in compliance with GDPR and applicable breach notification laws.
Systems are restored from clean backups. A full post-incident review is conducted within 30 days.