Security
Controls that apply to every account, every session and every transfer.
Credential protection
Passwords are never stored in plaintext. Credentials are hashed and managed by the authentication service; the application never sees a raw password.
Server-side authority
Balances, statuses, permissions and account state are decided by the database and backend only. Values sent from the browser are never trusted.
Verification challenges
Each stage issues a cryptographically random code bound to one transaction, valid once, with a 30-minute expiry and strict attempt limits.
Session and rate controls
Sessions expire, repeated failures are recorded as security events and excessive verification attempts lock the stage until an officer intervenes.
Audit logging
Every sensitive administrative action records the actor, role, target, transaction, previous status, new status, reason and timestamp.
Privacy by default
Administrators can never view a customer password or authentication secret. Support roles are restricted to read-only access.
Reporting a security concern
If you notice unfamiliar activity on your account, sign in and review the Security page for recorded events, then contact the support desk. Staff will never ask you for a password or a verification code.