Security

1. Two-factor and multi-factor authentication

QuantarisAI supports one-time-code two-factor authentication generated by an authenticator application on your phone. It is not compulsory at registration, because we do not want a lost phone to lock a brand-new client out completely, but we strongly recommend enabling it the same day your account is created, and your personal manager will walk you through it on the setup call.

If you lose access to your device, recovery is deliberately human: contact support from your registered email address, complete identity verification, and a reviewed process restores your access after a security hold. The hold exists because a recovery request is also what an attacker would try; a short, communicated delay is the honest trade-off.

For clients who want stronger assurance still, a second method can be layered: a recovery email distinct from the login address, and up-to-date recovery questions whose answers are not discoverable from social media. Your manager can review your 2FA setup with you in five minutes on any call, and we recommend doing so after any device change.

2. Encryption: in transit and at rest

All traffic between your browser and the platform is encrypted with TLS. Data you submit, from identity documents to payment details, is stored encrypted on the systems that hold it, and decryption is limited to the services that need the data to operate: verification, payments processing and client support.

Encryption is scoped, not decorative. Display-layer systems work with the minimum fields they need; full document images remain inside the verification boundary. When data retention periods expire, records are deleted rather than merely hidden.

3. Fraud and phishing protection

The genuine QuantarisAI website lives on our official domain, and we publish this fact precisely because impostors copy names and logos. Communications from us come from our own domain, never from look-alike free email accounts, and we never ask you to move funds to a "safe account", a wallet address quoted over the phone, or a person you met on social media.

Verified messages from the platform are also recognisable by content, not just by sender: security notifications reference the specific device and time, and support answers reference your existing ticket rather than asking you to re-state personal details. If a message pressures you to act in minutes, treats that pressure as the alarm. The Fraud warning page lists the clone patterns we have seen.

4. Login notifications

When a login happens from a device your account has not used before, you receive an email alert with the time, approximate location and device characteristics. Alerts are also generated for suspicious activity patterns, such as repeated failed logins or a password change, so that the first sign of trouble reaches you within minutes rather than weeks.

If an alert does not match something you did, do not investigate alone: change your password, revoke sessions (point 5) and contact support immediately. Fast reporting shortens incident response dramatically.

5. Device and session management

Your account keeps a list of active sessions with device and last-seen information. You can end any session from the security settings screen, including the one you are using, and sessions that remain idle beyond the configured timeout end automatically. Signing out on a shared computer is still good practice, but it is no longer your only lever.

A practical review rhythm serves most clients well: glance at the session list whenever you sign in from a new device, after any travel, and before any large withdrawal. The thirty seconds this costs is the cheapest habit in account security, and it converts an abstract setting into something you actually use.

Before travelling, or after losing a device, review the session list and revoke anything you do not recognise. A revoked device must re-authenticate, which an attacker without your password and second factor cannot do.

6. Account recovery

Recovering an account starts with identity verification: your registered details, identity documents and, where applicable, a liveness check. Requests are handled by the support team under review, not by an automated "forgot password" link that emails a reset to whichever address asks loudest. Compromised-email situations are escalated to a manager and use additional verification factors.

For speed, keep your registered email address current and unique to this account. A recovery is only as strong as the mailbox it lands in.

7. API key rights: read, trade, withdraw

Connections between QuantarisAI and service providers use API keys with separated scopes: reading account data, placing trades and initiating withdrawals are distinct permissions. A key configured for analysis cannot move money, and a key configured for trading cannot change your withdrawal details. Scope can be narrowed or revoked at any time from your security settings.

When your manager helps you connect a service, ask which scopes are being granted and why. If a key's purpose expires, revoke it; unused standing access is the quiet version of an unlocked door.

8. Audit history

Your account records logins, session starts, API connections and disconnections, and changes to strategies and settings, with timestamps. The audit history exists for the same reason a flight recorder does: when something surprises you, the sequence of events is checkable rather than debatable.

Make a habit of glancing at the audit view after any change you or your manager make. An entry you cannot explain is worth a support ticket, and entries you can explain are how you learn what the system actually did. On request, your manager will walk through any week of audit history with you on a call, which new clients often find the fastest way to understand what the automation genuinely does from day to day.

9. Incident support

If you suspect unauthorised access, a phishing attempt or a cloned site impersonating us, contact [email protected] immediately. On request we can place a temporary freeze on the account while the situation is reviewed, which stops further activity without closing anything permanently. Incidents are escalated internally within the support team, and you will hear from a named handler rather than an anonymous queue.

Expected communication order: an acknowledgement, then a named handler, then a summary of what was found and what changed as a result. Security questions never require you to disclose your password, your one-time codes or your full card number; anyone who asks for those is not us.