Security at Quanaliz

1. Two-factor authentication (2FA / MFA)

Two-factor authentication adds a second proof beyond your password: a time-based code from an authenticator app on your phone. We support any TOTP application, including Google Authenticator, Microsoft Authenticator and Authy. The second factor is optional but strongly recommended, and enabling it takes under two minutes from the security section of your dashboard.

Recovery is deliberately human. If you lose your device, contact support from your registered email address. We verify your identity against the records held on the account, ask for supporting documents where necessary, and restore access in a controlled process. We will never ask you to read a 2FA code aloud or send one to us; anyone who does is not Quanaliz.

2. Encryption of data in transit and at rest

All traffic between your browser and the platform travels over TLS, and the site certificate is checked continuously so an invalid certificate fails loudly rather than quietly. Personal records, identity documents and account activity are encrypted at rest in storage, with keys held separately from the data they protect.

Encryption applies across the systems that carry your information: the web application, the analytics core that processes market data, and the payment integrations that move deposit and withdrawal instructions. Access to decryption paths is limited to named engineering roles and is written into the audit log described in point 8.

3. Protection against fraud and phishing

The single most effective security measure is knowing which domain you are on. Quanaliz operates only at quanaliz.org, and every official email we send comes from an @quanaliz.org address. If a site, message or caller presents a lookalike domain or a free email account, it is not us, however convincing the design.

Our outbound messages never contain a request for your password, a 2FA code, or a payment into an account you have not seen in your own dashboard. Where a message needs you to sign in, it directs you to type the address yourself rather than follow a link. The Fraud warning page lists the cloning techniques we have seen and how to report them to us at [email protected].

4. Login and activity alerts

Each time a new device signs in to your account, you receive an email at your registered address describing the event. The same alerts fire for password changes, email address changes, new API keys and withdrawal requests. Alerts are informative rather than blocking: you can act on them instantly rather than discovering a change weeks later.

If an alert shows activity you do not recognise, treat it as urgent. Sign in, change your password, review the sessions list in point 5, and write to support in the same hour. A quick report is the difference between a closed door and an open investigation.

5. Device and session management

The dashboard lists every active session: browser, device type, approximate location and the time it began. You can end any session in a single action, which signs that device out immediately, and idle sessions expire automatically after a period of inactivity.

This matters most when a device is lost, shared or sold. Revoking a session does not change your password, so pair it with a password change whenever a device leaves your control. Support can also freeze the account entirely while you regain access to your email, which stops all logins, withdrawals and API activity until you confirm it should reopen.

6. Account recovery

Recovering an account always involves identity verification, never a simple email loop. We compare the details and documents you provide against those held on file, and where the account has elevated limits, we may require a live selfie check or a short call with the Client Support & Compliance team.

Recovery has deliberate limits. We will not bypass identity checks because a caller is in a hurry, and we will not restore access to an address that differs from the registered one without document-backed proof. This protects you, even when it is mildly inconvenient.

7. API key permissions

Where the platform connects to an exchange on your behalf, the connection key can carry only the permissions it needs: reading balances and market data, and placing or closing trades. Withdrawal permission is never requested and never enabled; funds move only through the withdrawal process on the platform, with your identity already verified.

Keys are stored encrypted, can be rotated at any time, and appear in your audit history when created, changed or revoked. If you ever want a connection severed immediately, you can delete the key yourself from the settings page without waiting for support.

8. Audit history

Every security-relevant event on your account is recorded: logins and failed login attempts, session terminations, password and email changes, new devices, API key operations, strategy setting changes and withdrawal requests. The history is visible to you, not only to us, from the audit tab in your dashboard.

Records are retained in line with our Privacy Policy and serve two purposes: they let you verify that nothing happened without your knowledge, and they give our team a precise timeline when investigating a report. Precision here is the point; a security log that omits events is worse than none.

9. Support during a suspected incident

If you suspect unauthorised access, a suspicious message or anything else worrying, contact [email protected] immediately, Monday to Friday, 9:00–17:30 GMT/BST (excluding public holidays). In your first line, state that it is a security concern: those reports are prioritised ahead of ordinary queue order.

The usual sequence is: your account is optionally frozen while facts are established; recent activity is reviewed with you against the audit log; credentials and keys are rotated; and the matter is escalated internally if a third party or a platform fault is involved. We aim to acknowledge security reports within one business hour and to keep you informed at each stage, in writing, until the matter is closed.