How signing in works

Three things happen every time, and knowing what they are makes it obvious when something is wrong.

01

Email and password

Your password is stored hashed and is never recoverable, by us or by anyone who asks us. If you have lost it, the reset link is the only route back in, and it goes to your registered address.

02

Your second factor

A code from your authenticator app, or a tap on a hardware key. This step is not optional and cannot be turned off from inside the account, which is deliberate.

03

A new device gets flagged

Signing in from a device we have not seen before is recorded and notified to you by email. If that email arrives and it was not you, change your password and tell us.

What is behind the login

The account is the product. Everything below lives inside it.

  • Open positions, order history and realised performance
  • The strategy builder, and every strategy you have saved
  • Your risk limits — per-trade size, daily loss cap, maximum drawdown
  • The switch between your demo balance and live trading
  • Deposits, withdrawals and the withdrawal address allowlist
  • Billing, invoices, and the button that cancels the subscription

If you cannot get in

Use the reset link on this page. It goes to your registered email address and nowhere else, and it expires shortly after it is issued. If the reset email does not arrive, check spam before writing to us.

Use one of the recovery codes issued when you switched two-factor on. If those are gone too, contact support from the address the account is registered to — recovery takes manual identity checks and is deliberately not instant.

Check spam, then confirm the address on the account is still one you can read. Notifications go to the registered address only, and we will not redirect them on the strength of an email asking us to.

Repeated failed attempts lock an account for a period, which clears on its own. If it does not clear, or you did not make those attempts, contact support and say so explicitly.

Change your password, revoke active sessions from the session log, and check the withdrawal allowlist for an address you do not recognise. Then contact support. Do that in that order — the allowlist is the part that matters most.

Two habits worth having

We will never ask you for your password, your two-factor code, or a recovery code — not by email, not on a call, and not in a chat window. Anybody who does is not us, however convincing the address looks. There is no internal process that requires any of them.

Reach this page by typing the address or from your own bookmark, rather than from a link in an email. Phishing pages for trading platforms are a routine, industrialised business, and a copy of this screen is trivial to build.