Authenticator codes
RFC 6238
Time-based one-time codes from any authenticator app, with single-use recovery codes issued when you enrol.
Security
Defence in depth, not defence in theory.
Every session is footprinted, every action is written to a trail nobody can quietly edit, and every sensitive operation sits behind a second factor you chose.
How you sign in
Never a password alone.
Device recognition
Every browser fingerprinted
New devices are challenged. You can see every sign-in and block any device you do not recognise.
Geographic firewall
Evaluated per request
Country, network and client-signature rules applied at the perimeter, before a request reaches your account.
Encryption at rest
AES-256
Sensitive fields are encrypted in storage, and secrets like authenticator seeds are never readable in the clear.
Immutable audit trail
Before and after
Administrative actions record who did what, from where, and what the value was beforehand.
What we will never do
How to tell it is really us.
Most losses do not come from broken cryptography. They come from someone convincing an account holder to open
the door themselves. If a message creates urgency and asks you to act immediately, stop and call the fraud
line on the number printed on this site.
-
We never ask for your password
Not by phone, not by email, not by message. Nobody here needs it.
-
We never ask for a one-time code
A code read aloud to somebody is a code handed to an attacker.
-
We never ask you to move money to safety
That instruction is fraud, every single time, whoever appears to be asking.
Your account, locked the way you want it.
Enrol an authenticator the day you open your account — it takes about a minute.