Your account is only as safe as the weakest link, so we combine protections on our side with settings that you control. Here is each safeguard, how it works and what we ask of you.
Two-factor sign-in
Login alerts
Device control
Scoped API keys
1. Two-factor and multi-factor authentication
Two-factor authentication (2FA) asks for a second proof of identity in addition to your password. Fexenvance supports time-based codes from an authenticator app and one-time codes sent by SMS. The app is the stronger option because codes are generated on your phone and cannot be intercepted by someone who takes over your number.
2FA is strongly recommended for every account and is required before you can enable withdrawals or change a payout destination. If you lose your phone, you can recover access with the single-use recovery codes shown when you set up 2FA, or by passing the identity checks described in point 6. Store the recovery codes offline, not in your email.
2. Encryption
Data sent between your device and our servers travels over TLS encryption, shown by the padlock in your browser. Personal data and credentials are encrypted when stored, and API secrets are held in an encrypted vault so that they are not visible in plain text to support staff.
Access to production systems is limited to named engineers and logged. Encryption protects data, but it cannot protect a password that you give away, which is why the next point matters.
3. Protection from fraud and phishing
Our only official domain is fexenvance-ai.co.uk. Copycat sites often differ by one letter or use a different ending, so type the address yourself or use your bookmark, and check the padlock and spelling before you log in.
Every genuine email we send to your registered address can include an anti-phishing code you set in your account. If the code is missing or wrong, treat the message as suspect. We will never ask for your password, full card number, 2FA code or recovery codes, and we will never ask you to install remote-access software. See the Fraud warning page for typical scams.
More protections, point by point
Points 4 to 9 are about noticing problems quickly and limiting the damage if something goes wrong.
4. Login notifications
We email you whenever your account is accessed from a new device or location, when a password or 2FA setting changes and when we notice activity that looks unusual, such as many failed sign-ins in a row. Push notifications can be added in the mobile browser if you prefer.
If you get a notification you did not expect, change your password at once, review your active sessions and contact support. Fast action is the best protection.
5. Device and session management
Your security settings list every active session with its device type, approximate location and last activity. You can sign out any session, or all of them, with one click.
Sessions end automatically after a period of inactivity, and a fresh sign-in is needed to change sensitive settings. Using a shared or public computer is not advised, but if you do, sign out and revoke the session afterwards.
6. Account recovery
If you cannot sign in, start with the password reset link sent to your registered email. If you have also lost your 2FA device and your recovery codes, contact support. We will verify identity with the same document and selfie checks used at registration before we reset anything.
This takes longer than a reset link by design. For a short period after recovery we may restrict withdrawals so that a thief who has taken over an account cannot empty it at once.
7. API key permissions
When you connect an exchange you decide what the key may do. We need read access to see balances and trade access to place orders. We recommend that you never enable withdrawal permission on a key you give to any third-party service, including us.
With trade-only keys, someone who obtained the key could place trades but could not send your coins to their own wallet. Where your exchange offers IP allow-lists, add ours. You can revoke a key at the exchange at any moment.
8. Audit history
The activity log in your account records sign-ins, device connections, API connections and every change to strategies and settings, each with a time stamp. Review it from time to time, because an unfamiliar entry is often the first sign of a problem.
Logs are retained so that we can investigate incidents and respond to lawful requests, in line with our Privacy Policy.
9. Incident support
If you suspect unauthorised access, email [email protected] with the word URGENT at the start of the subject line, or tell your personal manager. We can lock the account on request, block withdrawals and escalate to our security lead.
We will tell you what we find and what we are doing as soon as we reasonably can, and we will report incidents to the authorities where the law requires it. Where money has gone to a bank account, contact your bank straight away too.
Your part: a short checklist
Use a password of its own, ideally from a password manager, and never reuse one from another site.
Turn on authenticator-app 2FA and keep your recovery codes offline.
Secure the email account you registered with, because resets go there.
Keep your phone and browser up to date and avoid public Wi-Fi for financial tasks.
Create exchange API keys without withdrawal permission.
Security measures reduce risk but do not remove it. See the Risk disclosure for trading risks, and KYC and AML for identity checks.
Remember. No genuine member of our staff will ask for your password or a one-time code. If someone does, end the conversation and report it to [email protected].
Money held with a UK bank or building society may be covered by the Financial Services Compensation Scheme (FSCS), subject to its limits. Cryptoassets and balances used for trading are generally not covered by the FSCS.
How we protect the platform itself
Account features are only half the picture. Behind them, the platform is built and run with its own controls. Changes to the code go through peer review and testing before release, and a rollback plan exists for each one. Servers are kept patched, and administrative access needs multi-factor sign-in from a limited group of named staff.
We run automated vulnerability scans, and security-relevant code is reviewed by someone other than its author. Data is backed up on a schedule, and restoring from backup is tested so that we know it works before we need it. Suppliers that handle data for us are assessed before we use them and bound by contract to protect it.
If you believe you have found a weakness in our site, please report it to [email protected] and give us reasonable time to fix it before you tell anyone else. We will acknowledge reports promptly and will not take action against people who act in good faith.
What security cannot do
We cannot protect you from losses caused by market moves, and we cannot control the security of the exchanges you connect. If an exchange is hacked, the money held there may be at risk regardless of how well we have protected our own systems. Choose exchanges with care, keep only what you need on them, and read the Risk disclosure.