Security, layer by layer
An automated trading account holds money and personal data, so protection cannot be an afterthought. This page explains every layer we operate, in the order a client meets them: from the moment you create an account, through daily use, to the rare cases where something needs fixing.
At a glance
Two-factor authentication
A second proof at every login from a new device, with a documented recovery path.
Encryption
Data encrypted in transit and at rest, with access limited to the systems that need it.
Anti-phishing protection
Official domains, verified messages and a personal security code for every client.
Login alerts
Email notifications for new devices and suspicious activity, sent the moment it happens.
Session control
See every active session and end any of them from the dashboard in one click.
Audit history
Logins, connections and settings changes recorded and reviewable on request.
1. Two-factor authentication (2FA / MFA)
Two-factor authentication adds a second proof of identity on top of your password, and we support authenticator-app codes (TOTP) as the standard method. We strongly recommend enabling 2FA the day your account is activated; your personal manager will walk you through the pairing on the setup call if you wish. Once it is on, every login from an unrecognised device asks for a fresh code, which means a stolen password alone is no longer enough to reach your account.
If you lose access to your device, recovery is deliberately human: contact support from your registered email, complete identity verification, and the team will remove the old 2FA binding so you can pair a new device. We never send "click here to restore access" links by email, and any message claiming to do so should be reported to us immediately.
2. Encryption of data in transit and at rest
All traffic between your browser and the platform is encrypted in transit over TLS, so credentials, documents and account activity cannot be read in passage. Stored records, including identity documents collected during verification, are encrypted at rest within our storage layer.
Access to decrypted data is limited to the specific systems and roles that need it: the verification service reads identity documents, the reporting service reads activity summaries, and no single staff account can browse the full store. Keys are managed separately from the data they protect, and access rights are reviewed when roles change.
3. Fraud and phishing protection
We communicate from one official domain, tradevisor-ai.org, and one support address, [email protected]. Any website, app or message that contacts you "from Tradevisor AI" through another domain should be treated as suspicious and reported to us. Our Fraud warning page lists the patterns we have seen.
Every client can set a personal security code during onboarding. Legitimate calls from our team will reference your account in general terms but will never ask you to read out that code, your password, or full card numbers. If someone does, end the call and write to us from your registered address.
4. Login notifications
Each login from a new device or browser triggers an immediate email notification to your registered address, telling you where and when the login happened. Logins judged unusual for your pattern, such as a new country followed minutes later by a password change, raise an internal alert and can be held for verification before they proceed.
These notifications are read-only: they inform you, they never ask you to click a link to "confirm" anything. If a notification reports a login you do not recognise, change your password and contact support straight away; the session tools in the next section let you cut the intruder off yourself.
5. Device and session management
The dashboard lists every active session on your account: browser, approximate location and last activity. You can end any session individually or sign out everywhere at once, which is useful after losing a phone or using a shared computer. Sessions idle for an extended period end automatically, so a forgotten open tab does not stay live indefinitely.
Revoking a session does not change your password. If you believe the credentials themselves are compromised, end all sessions and then change the password, in that order, so the old one cannot be used to sign straight back in.
6. Account recovery
Recovering an account starts with proving who you are, not with a quick link. Write to [email protected] from your registered email, and the team will carry out identity verification against the records collected at onboarding, potentially including a live check with a member of the Client Support & Compliance team. Only then is access restored and, where relevant, 2FA re-paired.
Recovery has deliberate limits. We cannot restore access to an address that has never been associated with the account, and we cannot bypass identity verification for speed. These limits exist precisely because a recovery process that is easy for an attacker is worthless to you.
7. API key permissions
Where the platform connects to an exchange or service on your behalf, the keys involved carry only the permissions the function needs: read-only keys for monitoring market data, keys with trading rights where execution is required, and withdrawal capability deliberately kept separate. A key that only needs to read prices cannot move funds, by construction.
Keys are stored encrypted, rotated on a schedule, and revoked the moment their purpose ends. If you ever want to confirm which connections are active on your account, support can produce the current list, and the audit history in the next section shows when each was added or removed.
8. Audit history
The platform records the events that matter to account integrity: logins and failed login attempts, new device pairings, changes to strategies and settings, deposits and withdrawal requests, and changes to security options such as 2FA. Records are retained for a defined period and can be provided to the account holder on request through support.
This trail serves two purposes. Day to day, it lets you and our team reconstruct exactly what happened on the account, which makes disputes shorter and clearer. Less happily but just as important, it provides the evidence base for any investigation following a security incident.
9. Support during incidents
If you suspect a problem, your first move should be a message to [email protected] with the words "security concern" in the subject, and the subject line is monitored with priority. Where account safety is in question, support can place a temporary freeze on withdrawals while the situation is reviewed, which stops damage without locking you out of information.
You can expect an acknowledgement quickly during support hours (Monday to Friday, 9:00–17:30 GMT/BST (excluding public holidays)), a named person responsible for your case, and plain updates at each step: what we have confirmed, what we are doing, and what, if anything, we need from you. Once resolved, we close the loop with a short written summary so you have a record of what happened and how it was handled.
Security is a shared effort. We operate the layers described above; keeping your email account secure, using a unique password here and enabling 2FA are the three most valuable things on your side. If anything on this page is unclear, ask us directly rather than guessing: [email protected].