Security

1. Two-factor and multi-factor authentication

Two-factor authentication (2FA) adds a second proof at login: something you know (your password) plus something you hold (a one-time code from an authenticator app on your phone). StraitsVault AI supports time-based one-time codes from any standard authenticator app, and we recommend enabling 2FA on the day you create your account, before your first deposit.

2FA is strongly recommended for every account and is required before certain sensitive actions, including first-time withdrawal setup and changes to your linked payout details. If you lose access to your device, recovery is possible: contact support from your registered email, complete identity verification, and your manager will guide the reset. Recovery by design takes longer than normal login, because that friction is what protects you from an attacker pretending to be you.

2. Encryption of data at rest and in transit

All traffic between your device and the platform travels over TLS, the standard encrypted web transport, and we require modern protocol versions with no legacy fallback. Inside the platform, personal data and account records are encrypted at rest in the systems that hold them, and database access is restricted to the services that need it.

Encryption has a scope, and honesty about scope matters more than the word itself. In scope: your profile, verification documents, session data and activity records in our systems. Out of scope: anything you send over channels we do not control, such as plain email, and the internal systems of external venues your strategies connect to. Never send identity documents as email attachments; upload them only through the verification flow, which is encrypted end to end.

3. Fraud and phishing protection: official domains and message codes

Phishing is the attempt to trick you into entering your credentials on a fake site or revealing one-time codes to a person. Our messages always come from the [email protected] address or from the platform itself, and we never ask for your password, a one-time code, or remote access to your device. We will also never instruct you to deposit money into a named individual's account.

Type straitsvaultai.org into your browser yourself rather than following links in emails or adverts. Bookmark the login page after your first visit. If a message claims urgency, treat the urgency itself as the warning sign. Report suspicious messages that misuse our name to [email protected]; the Fraud Warning page lists the patterns we most often see impersonating us.

4. Login notifications

Every sign-in from a new device triggers an email notification to your registered address, showing the time, the approximate location derived from the network, and the device description. Reviewing these emails takes seconds and is the fastest way to catch an intrusion in progress.

You can also enable notifications for activity we classify as unusual, such as a login from a country you have never used, a change to your payout details, or a withdrawal that differs sharply from your history. If you receive a notification you do not recognise, do not click anything in the email: open the platform directly, change your password if the session was not yours, and tell support immediately. During support hours we can freeze withdrawals on the account while you verify.

5. Managing devices and sessions

The dashboard shows every active session on your account, with device type, sign-in time and location. You can end any session with one click, which is useful when you left yourself logged in on a shared computer or lost a phone. Signing out on all devices is available in the same place and takes effect immediately.

Idle sessions end automatically after a period of inactivity, and sessions expire fully on password change. For safety, review the session list after any trip, after selling or lending a device, and whenever a login notification mentions hardware you do not recognise. Session data itself is part of the audit trail described below, so revoked sessions remain visible as history.

6. Account recovery and identity checks

Recovering access starts with identity verification, not with a security question. Contact support from your registered email, complete the verification steps, and your case is handled by the Client Support & Compliance department, never by an automated reset link alone. This process exists so that an attacker who knows your email cannot take the account, and so that you can always get back in with proof of identity.

Recovery has deliberate limits: payout details cannot be changed during an open recovery case, and withdrawals pause until verification completes. These pauses are protection, not punishment. If anyone contacts you claiming to speed up recovery for a fee or a code, that person is a fraudster; real recovery only ever runs through the official channel above.

7. API key permissions: read, trade, withdraw

Connections to external venues use API keys with scoped permissions. A read-only key can view data, a trading key can open and close positions, and withdrawal permission is a separate level that trading does not require. The platform requests the narrowest scope a strategy needs, and we recommend you never enable withdrawal permission on any key used for automated trading.

Review your keys in the settings panel: check which are active, what scope each has, and when it was last used. Rotate a key if a tool or service you no longer use still holds one, and revoke immediately any key you did not create. Key events are logged, so an unrecognised key in the list is also visible in the audit trail, with the moment it was created.

8. Audit history of logins, connections and changes

Every security-relevant event on your account is recorded: logins and their outcome, devices added, sessions revoked, API keys created or deleted, strategy starts and pauses, parameter changes, payout-detail edits and withdrawal requests. The history is available to you in the dashboard and to our compliance team internally, and entries cannot be edited or deleted by anyone, including us.

The audit trail serves three purposes. It lets you reconstruct exactly what happened after an unexpected change. It lets our team investigate an incident with facts instead of impressions. And it is the evidence base for any complaint or dispute, because both sides see the same immutable record. We recommend scanning recent entries as part of your weekly review; it takes less than a minute.

9. Support during a security incident

If you suspect your account is compromised, act in this order: change your password from a device you trust, end all other sessions, then email [email protected] with the subject line "Security incident". During support hours (Monday to Friday, 9:00–18:00 SGT) the team responds usually within one business hour, and account-level protections, including a withdrawal freeze, can be applied while the case is open.

An incident case stays with one handler until it is closed, so you do not retell the story to a new person each time. Expect a clear sequence: containment first, verification of what happened from the audit trail second, and restoration of normal function last. If funds were moved before containment, the case file supports reporting to your bank, the payment provider and the Police; in Singapore, financial crime is reported through the Police hotline 1800-255-0000 or the ScamShield Helpline 1799, and we will provide the records they need.