Your money and your personal information are only as safe as the weakest link. This page sets out what we do, what you can switch on and what to do if something goes wrong.
Security reduces risk. It cannot remove it, and trading losses are never covered by security measures. If you only read one section, read the list of things you can do today near the bottom of this page.
Nine layers of protection
1. Two-factor authentication (2FA)
Two-factor authentication adds a second proof of identity to your password. We support time-based codes from an authenticator app and one-time codes sent to your registered mobile. App codes are the stronger choice because they are not exposed to SIM-swap attacks.
Two-factor sign-in is strongly recommended for every account and is required before you can make a withdrawal. If you lose your phone, you can recover access using the backup codes shown when you set up 2FA, or by passing a manual identity check with our support team.
2. Encryption
Data travelling between your device and our systems is protected with TLS, the same technology that secures online banking, so it cannot be read in transit. Sensitive information stored on our systems, including identity documents and credentials, is encrypted at rest.
Encryption applies to the website, the mobile experience and the services that handle verification and payments. Access to the keys is limited to a small number of authorised systems and staff, and every access is logged.
3. Fraud and phishing protection
We only communicate from our official domain, https://valorstead-ai.org, and from email addresses that end with our domain name. Anything that arrives from a different address, or that asks you to log in through a link you did not request, should be treated as suspicious.
You can set an anti-phishing code in your account settings. Once it is set, genuine emails from us include that code. If it is missing, the email did not come from us. Our staff will never ask for your password, your codes or your API secret, by email, phone or chat.
4. Login notifications
Every time your account is signed in to from a new device or a new location, we send an email so that you can confirm that it was you. You can also choose to receive the same notice as a push message in the app.
Unusual activity, such as repeated failed sign-ins, a change of password or a new payout method being added, triggers an immediate alert. If you did not make the change, follow the link in the message to lock your account straight away.
5. Device and session management
The security page of your account lists every device that is currently signed in, with the approximate location and the time of last activity. You can end any session with one click, which immediately revokes that device's access.
Sessions end automatically after a period of inactivity, and a session is closed when you change your password. We recommend that you sign out on shared or public computers and avoid saving your password in a browser on a device that others use.
6. Account recovery
If you cannot sign in, you can start recovery from the login page. We verify your identity by checking your registered email, your phone and, where needed, a document and a short live check that matches your ID with your face.
Recovery is deliberately cautious. After an account has been recovered, withdrawals and changes to payment details may be limited for a period so that anyone attempting to take over your account has no opportunity to move funds out.
7. API key permissions
When you connect an exchange, the platform asks for specific permissions. Read-only keys can see balances and activity. Trading keys can place and cancel orders. Withdrawal permission can move funds off the exchange, and we do not ask you to enable it.
Create keys with the smallest set of permissions that your strategy needs, restrict them to our server addresses if your exchange allows it and delete keys you are no longer using. You can revoke access from the exchange at any time, and our system stops immediately.
8. Audit history
Your account keeps a record of the sign-ins, device connections, exchange connections, strategy changes and settings changes made over time. The log shows the date, the time, the type of event and the device it came from.
Reviewing the log once a month is a quick way to check that every action was yours. If you spot something you do not recognise, tell us at once and we will preserve the record and begin an investigation.
9. Incident support
If you suspect that your account has been accessed without your permission, contact us at [email protected] or ask your account manager to lock the account. A locked account cannot trade, change its settings or withdraw until you and our team have gone through the checks.
We acknowledge security reports promptly, escalate them to a dedicated specialist where needed and keep you informed about progress and what to expect next. Where a data breach affecting you has occurred, we will notify you as the law requires.
What you can do today
Most account takeovers are not clever hacks. They happen because a password was reused or a code was handed over. A few minutes of setup closes the most common doors.
Switch on two-factor authentication with an authenticator app.
Use a long, unique password from a password manager.
Set your anti-phishing code and check it in every email.
Review signed-in devices and remove any you do not know.
Make sure your exchange API keys cannot withdraw.
How we protect the platform
Access to production systems is restricted to named staff and requires two-factor sign-in. Changes go through review and testing before release, and infrastructure is monitored around the clock for unusual behaviour.
We run regular vulnerability checks, keep software patched and rehearse our response to security incidents so that decisions are not being made for the first time when they matter.
How your assets are treated
Cash, shares and crypto-assets are treated differently under Australian rules, and it helps to be clear about the difference. Money held in an Australian bank account at an authorised deposit-taking institution may be covered by the Financial Claims Scheme, up to a limit set by the government. That protection applies to the bank deposit, not to the trading platform.
Crypto-assets and other digital assets are generally not covered by that scheme. If a provider that holds them fails or is compromised, you may not recover your money. Trading losses are not insured in any case.
If you find a weakness in our website or platform, we would like to hear about it. Please report it to [email protected] with enough detail to reproduce it, and give us reasonable time to fix it before you share it more widely. We will thank you and tell you what we did, and we will not take action against anyone who reports in good faith.
For what this means for you in practice read the risk disclosure, and for how identity and activity are checked see the KYC and AML/CTF page.