Every layer of your account, explained

2FA is required on every account before trading can start. Authenticator apps are the primary method; SMS codes remain a fallback where an app is genuinely not possible, because SIM-swap fraud makes SMS the weaker choice. Enrolment takes about a minute during activation, and the recovery codes belong somewhere safe that is not your phone. If you lose your device, recovery is a verified process rather than a link: you prove your identity through the checks in section 6, and a new 2FA binding is set with your manager on the call.

Data in transit travels over TLS. Data at rest, including the identity documents you submit for verification, is encrypted at the storage layer, and decryption rights are limited to the service roles that need them across the account database, the verification vault and the backups. Encryption does not protect a password you reuse on other sites; that is why the controls below exist alongside it.

Our official domain is klondiketradeai.com, and it is the only domain we use to contact you. Clone sites are the most common fraud in this industry, and the cheapest defence is the habit of checking the address bar before typing a password. We never ask you to read a password, a 2FA code or a card number back over the phone. When your account manager first calls, they confirm details you can verify independently, such as your registration email. You can always hang up and call back through the official channel; a real employee will encourage exactly that.

Every sign-in from a device your account has not seen before triggers an email with the time, approximate location and device type. It is on by default because it costs nothing and catches trouble early. Suspicious patterns, such as a login from a new country shortly after a password change, alert our security team as well as you. A notification you do not recognize is urgent: change your password from a trusted device, then contact support.

Your dashboard lists the sessions signed in to your account, with the time each was last active. One click revokes any of them, signing the device out and requiring a fresh 2FA login. Sessions also expire after inactivity, so a hotel computer does not stay signed in by accident. After a revocation, trading from that device stops too, because strategy actions ride on the same session.

Recovering a locked account is an identity-verification process, not a "forgot password" email. We check what only you should know and hold: your registered details, your onboarding documents and, for higher-risk cases, a live video check against the document on file. Recovery happens with your account manager on a recorded call and is confirmed in writing.

It is slower than an automated reset, and that is the point: an attacker who cannot pass these checks cannot take your account by asking. During recovery we hold withdrawals, lifted as soon as verification completes, normally within one business day.

Where the platform connects to an exchange for you, it uses API keys with the narrowest scope that works: reading account data and placing trades. Withdrawal permissions are not requested, not stored and not used, so a compromised key cannot move funds off the exchange by itself. Keys are encrypted and rotated on a schedule. Your dashboard shows which connections exist and when each key was last used, and you can revoke a connection at any time; the strategies that depended on it stop rather than failing silently.

Significant actions are written to an audit log: logins, exchange connections, strategy starts and stops, risk-setting changes, withdrawal requests. Each entry shows the time, the acting party and the IP address, and the log cannot be edited after the fact by anyone, including us. You see your own events in the dashboard, in the same format we keep internally; when something surprises you, the log answers "who did this and when". Records are retained under our retention obligations and are available in disputes through the complaint process.