Security: how Auredane protects your account
Security on this platform is a set of everyday working practices, not a badge on a page. This page describes each protection, how it behaves in normal use and what to do when something looks wrong. It is written to be read once, properly, rather than skimmed.
1. Two-factor authentication (2FA / MFA)
Two-factor authentication adds a second proof, a code from an authenticator app on your phone, to your password. Auredane supports time-based one-time password (TOTP) apps, which work without a mobile signal. 2FA is optional at login but is required before the first withdrawal to a new destination, because that is the moment an account is most worth stealing.
We strongly recommend enabling it for every login. If you lose your device, recovery is handled by the support team through identity verification, never through an emailed code alone, and re-binding a new device invalidates the old one immediately.
2. Encryption in transit and at rest
Every connection to Auredane uses TLS, so passwords, personal details and session tokens cannot be read in transit. Data stored on our systems, including the identity documents you supply during verification, is encrypted at rest with access restricted to the specific teams whose roles require it.
Encryption covers the systems Auredane operates directly. Where a payment provider or exchange processes your data, their security standards apply as processors under our data protection arrangements, described further in the Privacy Policy.
3. Anti-fraud and phishing protection
Auredane communicates from one official domain and one set of published addresses. We never ask for your password, your 2FA codes, or remote access to your device. Any message that does, however convincing its layout, is not from us.
Each client can set a personal security word with their manager, which we reference in outbound calls so you can check who is speaking. If a website, advert or caller claims to represent Auredane and something feels wrong, stop, do not click, and write to [email protected]. The fraud warning page lists the clone patterns we are aware of.
4. Login and activity notifications
You receive an email alert when your account is accessed from an unrecognised device, when a withdrawal is requested and when a strategy or limit is changed. Alerts arrive within minutes of the event, which turns a silent takeover into a loud one.
If an alert describes something you did not do, use the link in the alert to secure the account or contact support directly. Fast reporting is the single most effective response to unauthorised access.
5. Managing devices and sessions
The security section of your dashboard lists every active session with its device type, approximate location and sign-in time. You can end any session instantly, which logs that device out everywhere, or sign out of all devices at once when you want a clean start.
Sessions expire automatically after a period of inactivity, and a repeated password failure introduces a delay before the next attempt. These small frictions are deliberate: they make guessing and automated attacks impractical without affecting normal use.
6. Account recovery done properly
Recovering access after a lost phone or forgotten password starts with identity verification: your registered details plus the documents from onboarding, and your security word if you set one. Recovery is performed by the support team, not an automated form, precisely so that an attacker cannot script their way in.
For your protection, a recovered account has withdrawals paused for a short review period, because recovery is also the classic route an attacker would try. Support will tell you the expected timing when you begin.
7. API key permissions, scoped narrowly
Connections to exchanges are made through API keys with the narrowest workable permissions: read market data, read balances and, where a strategy requires it, place orders. Withdrawal permission is separate and is never requested by the platform's own strategies.
Keys are stored encrypted, are bound to specific functionality and can be revoked from the dashboard. If a key must be replaced, your manager can usually arrange the change without interrupting your active strategies for long.
8. Audit history you can read
Every login, API connection, withdrawal request and change to strategies or limits is written to an append-only history in your dashboard. Entries carry a timestamp, the device or channel responsible and the value before and after the change.
This record serves two purposes. It lets you reconstruct exactly what happened on your account after an unexpected result, and it gives our support team an authoritative trail when investigating a report, so disputes rest on facts rather than memories.
9. When something goes wrong: incident support
Security incidents are handled in the open, quickly and in a fixed order.
Report it
Write to [email protected] with what you saw and when. If your account may be compromised, say so in the subject line; suspected compromises jump the queue.
We contain it
On confirmation, the account is suspended for trading and withdrawals first, then investigated. Freezing activity before diagnosis protects funds, and the freeze lifts the moment the all-clear is given.
You stay informed
Incident owners update you at agreed intervals, walk you through the findings and, where a third party is involved, coordinate the escalation. Nothing is closed silently.
Security questions are welcome before they become incidents. The team answers during Monday to Friday, 9:00–17:30 GMT/BST (excluding public holidays), normally within usually under one business hour. For the legal side of data handling, read the Privacy Policy; for how verification fits into onboarding, the AML / KYC page; and for the honest limits of what any platform can control, the risk disclosure.