Security and phishing

1.5Contacting us. You can contact us on any matter through the authenticated support channel in your Account or by email at [email protected]. Complaints should be sent to [email protected]. These are our only official email addresses for communication with Clients. We will never ask you for your passwords, private keys, seed phrases or one-time security codes.

6.3Security measures. You must, and must ensure that each Authorised User will:

1. (a)use multi-factor authentication and all other security features we require;
2. (b)keep passwords, API keys, one-time codes and devices secure and confidential, and never share credentials between individuals;
3. (c)access the Platform only through the official Website or applications and verify the website address before logging in;
4. (d)maintain up-to-date antivirus, operating system and browser software on devices used to access the Platform;
5. (e)use dual control (separate initiation and approval) for withdrawals and payments where the Platform offers it; and
6. (f)promptly remove access for any Authorised User who leaves your organisation or no longer requires access.

6.5Compromise of credentials. If you suspect that your Account or any credential has been compromised, or that an unauthorised Order has been given, you must notify us immediately through the emergency contact channel published on the Website or in your Account, or by email at [email protected], and request that we block the Account. We will act on such a request as soon as reasonably practicable. We are not liable for Orders executed before we have had a reasonable opportunity to act on your notification.

6.6No requests for secrets. We will never ask you to disclose your password, one-time codes or any private key. Treat any such request as fraudulent and report it to us.

23.5Fraudulent communications. We will communicate with you only through the official channels listed on the Website. You must check that any communication purporting to come from us is genuine before acting on it, and report suspected phishing or impersonation to us immediately.

3.2Data we do not ask for. We do not ask you to provide passwords, private keys, seed phrases or one-time security codes, and we will never request them. We do not intentionally collect sensitive personal data except as described in Section 7.

10.3Your role. You can help protect your data by keeping your credentials secure, using multi-factor authentication, accessing the Platform only through our official Website and applications, and reporting any suspected phishing or unauthorised access to us immediately.