Your account holds personal data and access to a trading platform, so we treat it like a vault with several doors. This page walks through the nine controls that protect it, what each one does for you and what you can switch on yourself.
Two-factor authentication adds a second proof of identity to your password. We support one-time codes from an authenticator app and codes sent by SMS to your Singapore mobile number, and an app is the stronger of the two.
The second factor is switched on during onboarding and is required for sign-in, for changing payout details and for creating API keys. If you lose your device, recovery goes through identity checks described below.
Do this: install an authenticator app, store the backup codes offline and remove old phone numbers from your profile.
2. Encryption
Data moving between your browser, our servers and exchange connections is encrypted in transit with current TLS. Data stored on our systems, including identity documents and API credentials, is encrypted at rest.
Decryption keys are held separately from the data, and access is limited to the services and staff who need it. Encryption is applied to the whole platform, not only to the sign-in page.
Do this: check for the padlock and the correct address before you sign in, and keep your own devices updated so the protection is not undone at your end.
3. Fraud and phishing protection
We only communicate from the official domain shown in the address bar of this site and from [email protected]. Verified messages carry a personal security code you set in your profile, so a fake email cannot reproduce it.
We will never ask for your password, one-time code or API secret, by email, SMS or phone. If a message does, treat it as fraud and use the fraud warning page to report it.
Do this: set your security code in the profile, bookmark the real address and delete messages that put you under time pressure.
4. Login notifications
Every sign-in from a new device or location triggers a notification by email, and by push if you use the mobile app. The message shows the time, approximate location and device type, with a link to lock the account if it was not you.
Suspicious patterns, such as repeated failed attempts or sign-ins from two countries within minutes, trigger an extra challenge before access is granted.
Do this: keep your notification email current and act on an alert you did not expect within minutes, not days.
5. Device and session management
The security section of your profile lists every active session with device, browser and last activity. You can end any session, or all sessions at once, and access is revoked immediately.
Idle sessions end automatically after a short period, so a laptop left open in a café does not keep your account open. Sensitive actions ask for the second factor again.
Do this: review the session list monthly and after travelling, and end sessions on shared or borrowed devices as soon as you finish.
6. Account recovery
If you lose access, recovery starts with identity verification: a live check against the documents on file and confirmation of details only you would know. Our support team cannot bypass this step, even for a convincing caller.
After recovery, withdrawals to new destinations can be held for a cooling-off period and all API keys are revoked, so you start from a clean state.
Do this: keep a record of the email address and mobile number on the account, because recovery is far quicker when they match our files.
7. API key permissions
When you connect an exchange you create the key there and choose what it may do. The platform needs permission to read balances and to place orders. It does not need permission to withdraw, and you should leave that switched off.
Where the exchange supports it, restrict the key to our published IP addresses. If you ever suspect exposure, delete the key at the exchange and the connection stops at once.
Do this: create one key for each tool, name it clearly, and rotate it at least once a year.
8. Audit history
Your account keeps a time-stamped record of sign-ins, device connections, API key changes, strategy edits and settings updates. You can read it at any time, which is the quickest way to confirm that nothing happened that you did not do.
The same history is available to our security team during an investigation, with access to it logged as well.
Do this: open the history after every change to your strategies and compare it with what you remember doing.
9. Incident support
Report a security concern by email or through your personal manager. Reports are monitored around the clock, and on request we lock the account first and investigate afterwards.
You can expect an acknowledgement quickly, a named contact for the case, and updates at each step until it is closed. If a problem affects data protection, we follow the breach notification duties under the PDPA.
Do this: include the time, the screen you were on and any message you received, and save the email or screenshot before you forward it.
A five-minute routine
Once a month: open the session list and end anything you do not recognise, skim the audit history for changes you did not make, confirm that the API key still has only read and trade rights, check that your email and mobile number on file are current, and update your phone and browser. Five minutes covers most of what an attacker would try, and it leaves you with a habit that also makes unusual activity easier to notice.
Warning signs
An email that arrives unprompted and asks you to act within minutes, a caller who knows your name and wants a code, a "support" chat that begins on social media, or a request to install remote-access software. Any of these means stop, close the conversation and contact us through the address on this site.
Security is a shared job. We protect the platform, and you protect your devices and passwords. Use a unique password, keep your phone updated and never share a one-time code with anyone, including people who claim to be from Finorix Pro.
Who does what
Security works best when each side knows its part. This is how we split it.
Area
What we do
What you do
Sign-in
Require a second factor and challenge risky logins
Use a unique password and an authenticator app
Data
Encrypt in transit and at rest, limit internal access
Keep devices updated and locked
Messages
Send only from official addresses with your security code
Ignore requests for codes or passwords
Exchange access
Work within the permissions you grant
Never enable withdrawals on the key
Monitoring
Watch for unusual behaviour and alert you
Respond to alerts quickly
Incidents
Lock, investigate and keep you informed
Report early and keep evidence
Questions about any control? Your personal manager can walk you through it on the phone, or you can read the FAQ. For how identity checks tie into security, see the KYC and AML policy.