Account and platform security

1. Two-factor authentication (2FA/MFA)

The platform supports two methods: an authenticator app (Google Authenticator or similar) and SMS codes. The app is safer, because its codes are generated on your device and never travel across the network. On every new sign-in from an unfamiliar device the platform asks for the second factor.

Two-factor authentication is optional, but we strongly recommend it for every user: without it, a leaked password alone is enough to enter. If you lose the authenticator device, you use backup codes: print or write them down and keep them somewhere safe. Restoring 2FA involves identity verification and contacting support.

2. Data encryption

Everything exchanged between your browser and the platform passes over an encrypted protocol (TLS): the data cannot be read in transit. Passwords are never stored in plain text, only as one-way hashes. Identity-verification data sits in separate systems with restricted staff access.

Encryption covers the core stores: email address, phone number, KYC documents and operation history. Encryption keys are rotated regularly, and the key list is accessible only to security engineers. Automated checks confirm the ciphers and certificates every time you open the account page.

3. Anti-fraud and phishing protection

The platform's only official domain is alif-ai.com: any other site bearing the "Alif AI" name is third-party or a clone. Our official messages always come from the official mailbox and never ask for your password, a 2FA code or card details. For important exchanges every user receives a personal protection code that is confirmed during phone or email contact.

Check the domain before filling in any form: fraudsters usually change one or two letters. If a message looks suspicious, do not click: forward it to support so we can verify it. The simple rule: if anyone asks you for a password or confirmation code, it is a scam, even if they say our name.

4. Login and suspicious-activity alerts

We email you about every successful sign-in: time, device type and approximate location. If you see an unfamiliar entry, press the "This was not me" button: the account is temporarily suspended and support contacts you. Alerts are also sent for password changes, key updates and withdrawal requests.

Suspicious activity (for example repeated login attempts from different IP addresses) triggers the monitoring system: we may temporarily hold the sign-in and ask you to confirm identity. It can cost a few extra minutes, but it keeps your account yours. Want alerts on your phone as well? Switch it in the Notifications section.

5. Device and session management

In the Devices and sessions section you see every device that has entered your account: type, browser and last seen. The "Log out" button instantly closes any session. Sessions without activity close automatically after 24 hours, and financial operations require renewed confirmation.

When selling a phone or using a shared computer, always sign out everywhere and change your password. Use only a private or mobile network for sensitive work: open public Wi-Fi is a favourite place for fraudsters to listen in.

6. Account recovery

If you forget your password or lose email access, recovery proceeds through verification questions and identity checks. We will ask for an identification document and a short video conversation: these steps exist so that nobody but you reaches your account. Recovery starts with one message to support and usually finishes within one business day.

For fast recovery, keep your 2FA backup codes somewhere safe. Never hand them to anyone: our staff never ask for backup codes. Any request for personal codes is a sign of fraud.

7. API key permissions

Every API key has three permission levels: read (viewing markets and history), trade (placing operations) and withdraw (transferring funds). For analysis a read key is enough; for executing a strategy you need read plus trade. Enable withdrawal rights only in specific, well-defined cases.

Keys have expiry dates in your profile and can be revoked at any moment. If a key is exposed, revoke it in the dashboard immediately and issue a new one. Review the list of active keys monthly: a forgotten old key can be a hidden door into the account.

8. Audit history

Every important action is written to the audit log: sign-ins and sign-outs, password changes, key creation and revocation, strategy changes and withdrawal requests. You can view this history in the personal dashboard and spot any discrepancy immediately. The records are append-only: entries are only ever added, and they serve as a live trace of account movements.

A good habit: scan the history weekly. If you notice an unknown action, report it to support formally. Monthly reports also rely on audit records, so every figure in your account is traceable.

9. Incident support

If you suspect your account has been compromised, use the "Freeze my account" button in the dashboard or write immediately to [email protected]. Your request goes to the security group: the account is temporarily frozen, operations are held and log analysis begins. A first reply usually arrives within one business hour.

The communication order is simple: we always write from the official address, explain the progress step by step and close with a clear conclusion. Where necessary we help you rotate passwords and keys and redo identity verification. Reading the fraud warning page also helps you prevent the next incident.