Account and platform security
Security at Aurora Finspire combines account controls, protected data handling, permission limits and a documented incident response. No technical control can eliminate every threat, so users also need to protect devices, credentials and recovery channels.
1. Multi-factor authentication
Users can add an authenticator app or supported one-time code as a second factor. We strongly recommend enabling it before connecting an account or making a payment. Recovery requires identity checks and cannot be completed solely by someone who controls the email inbox.
2. Encryption and data boundaries
Connections use current transport encryption, while sensitive stored records are encrypted with controlled key access. Encryption applies to platform-managed systems; it cannot protect information copied to an unsafe personal device or sent to an impersonator.
3. Fraud and phishing protection
Official communication uses this domain and will never ask for a password or one-time code. Users should type the address directly, check the sender and report lookalike domains. A support agent can confirm whether a message genuinely came from us.
4. Login notifications
Email or push alerts can identify a login from a new device, a password change or activity that differs from normal patterns. An alert is a prompt to inspect the session list, not proof by itself that a compromise occurred.
5. Devices and active sessions
The account area lists active sessions with approximate time and device information. Users can revoke access, sign out other devices and enable automatic session expiry. Shared computers should never be marked as trusted.
6. Account recovery
Recovery may require identity evidence, an existing contact channel and a manual support review. Access can remain restricted while conflicting information is investigated. This delay protects the account from social-engineering attacks.
7. Connection permissions
Where external access keys are used, permissions should be limited to the function required. Read, trading and withdrawal permissions are separate. Withdrawal access should remain disabled unless a documented function genuinely requires it.
8. Audit history
The audit view records logins, connection changes, settings updates and strategy actions. Users should review it after an unexpected alert or result. Records assist investigation but do not prevent market losses or user mistakes.
9. Incident support
If you suspect unauthorised access, contact [email protected], revoke unfamiliar sessions and secure the linked email account. Support can restrict access, preserve logs and escalate the case. We communicate investigation milestones without exposing security-sensitive detail.