How we keep you safe
Account protection, encrypted handoffs, and platform-level safeguards — layered so no single point of failure puts your funds or your account at risk.
Account protection
Two-factor authentication
Enable 2FA in your security settings to protect your account with a time-based one-time password (TOTP). All admin accounts require it.
Session management
Active sessions are tracked per device and can be revoked individually from Settings → Sessions. Sessions expire automatically after 30 days of inactivity.
Device fingerprinting & risk scoring
Logins from a new device or an unusual pattern are flagged automatically. High-risk accounts get additional review before sensitive actions.
Data & transfer security
Encrypted credentials
Account credentials shared during a transfer are encrypted at rest and only ever accessible to the intended recipient and our escrow system — never in chat, never in plaintext.
KYC identity verification
Identity verification uses liveness detection and document authentication. Verified sellers carry a visible badge and have a measurably lower dispute rate.
Platform safeguards
Rate limiting & brute-force protection
Login, registration, and sensitive API endpoints are rate-limited per IP. Repeated failed login attempts trigger a temporary lockout.
Responsible disclosure
Found a security issue? Email us with details — we investigate every report promptly and credit researchers who help us improve.
Found a security issue?
We take reports seriously and investigate every one. Responsible disclosure is credited, not punished.
[email protected]or use the contact form →