Website and account security

1. Two-factor authentication (2FA / MFA)

The platform supports time-based one-time codes (TOTP) from authenticator apps such as Google Authenticator, Authy or Aegis, and one-time codes delivered by email as a fallback method. 2FA is optional to enable but strongly recommended, and once active it is required at every login from a new device and for sensitive actions such as changing payout details.

Recovery is designed so you are never locked out forever: when you enable 2FA you are shown backup codes to store offline. If you lose both your device and your codes, identity verification through support restores access after a cooling-off period, which exists to prevent an attacker from using "recovery" as a way in.

2. Encryption

Data is encrypted in transit using TLS on every page and API call, and sensitive data is encrypted at rest in the systems that store your profile, verification documents and account activity. Key management is separated from the systems that use the keys, so a compromise of one application server does not expose the store. Payment pages never see your full card details; card data is handled by the payment provider's own secure fields.

Encryption is also scoped honestly: it protects data at rest and in transit, but it cannot protect an account whose password was handed to an impostor, which is why the other layers on this page exist. Internal access to stored personal data follows need-to-know rules, and every access by staff is logged and reviewable in audits.

3. Fraud and phishing protection

Our official domain is vestaccrue-ai.com, and it is the only domain where you should ever enter your VestAccrue credentials. Messages we send come from that domain, address you by name, and never ask for your password or a 2FA code. As an additional check, the dashboard shows a personal security phrase you choose at registration; genuine communications from staff reference it when discussing account matters by phone.

If a site, email or caller claiming to be VestAccrue asks for credentials, codes, or remote access to your device, it is not us. See the Fraud Warning page and report it to [email protected] immediately.

4. Login notifications

Every sign-in from a new device or browser triggers an email notification with the approximate location, device type and time. Repeated failed login attempts on your account also generate alerts and can trigger a temporary lock that only you, through your registered email, can release. Push notifications for key events are available in the dashboard preferences.

If you receive a login alert you do not recognize, change your password immediately, review active sessions (next section), and contact support. Speed matters more than certainty here: a false alarm costs you five minutes, a real one ignored can cost far more.

Alerts are deliberately hard to silence completely: you can change notification channels, but login alerts for new devices always go to your registered email while your account is open. This is one of the small design choices that trade convenience for safety, and we think it is the right trade.

5. Device and session management

The dashboard lists every active session: browser, device, IP address and last activity. You can revoke any session with one click, sign out everywhere at once, or set trusted devices that skip repeated 2FA prompts. Sessions expire automatically after a period of inactivity, and sessions on public computers expire faster and never persist your login state.

Make a habit of reviewing the session list after travelling, after using a shared computer, or after any alert. Revoking a session does not affect your strategies; it only closes that particular access to your account settings.

6. Account recovery

Recovering an account starts with verifying that you are the owner: matching identity documents from onboarding, the registered email, and details of recent account activity that only the account holder would know. Recovery requests are handled by the support team with a mandatory cooling-off period before payout details can be changed, because changed payout details are the most common goal of account takeover attempts.

To keep recovery fast, keep your registered email secure and current, and store your 2FA backup codes offline when you enable 2FA. An account whose recovery path still works is safer than an iron door with no key.

7. API key rights

Exchange connections use API keys with explicit permission scopes: reading market data and account state, and placing and closing trades. Withdrawal permission is a separate scope that the platform never requests, never stores and cannot use. You can confirm this yourself on the exchange when creating the key, and revoke the key on the exchange at any time, which takes effect immediately.

When a key is created, its permissions and expiry are recorded in your audit history (next section), so you always have a record of exactly what access you granted and when.

8. Audit history

Your account keeps a tamper-evident audit log of logins (successful and failed), exchange connections and key changes, strategy activations, pauses and setting changes, and payout detail updates, each with a timestamp and IP address. The log is available in the dashboard and can be exported for your records.

Use it in your monthly review: a one-minute scan confirms that every change in the last month was made by you. Anything you do not recognize should be reported immediately; the audit trail gives support exactly what it needs to react.

9. Incident support

If you suspect unauthorized access, contact [email protected] with "URGENT" in the subject line or call during support hours; suspected account compromise cases are escalated past the normal queue. As a first response, support can freeze logins and payouts on your account while verification happens, which stops an attacker without stopping your strategies from closing existing positions safely.

You will receive a named contact, an expected timeline, and updates at each stage until the incident is closed. After resolution you get a written summary of what happened, what was affected and what changed to prevent a repeat.