Security

1. Two-step verification (2FA / MFA)

Two-step verification adds a second lock to your account: after your password, you confirm a code generated on your device. SabioTrade supports authenticator applications and email codes as second factors. The feature is optional, but we recommend switching it on the day your account is created, because it defeats the most common attack on trading accounts: a password reused elsewhere and leaked in an unrelated breach.

If you lose the device that generates your codes, recovery is deliberately careful. You confirm your identity with our support team, and re-enable access after verification rather than with a simple email click. The delay is the point: a recovery process that is fast for you is also fast for an impostor.

2. Encryption of data

Data moving between your browser and the platform is encrypted in transit using modern TLS, which prevents interception on shared networks. Data kept by the systems that run registration, account settings and activity logs is encrypted at rest, so a physical disk or backup in the wrong hands does not by itself expose your details.

Encryption applies wherever your information lives: the account database, the records produced for verification under our AML / KYC policy, and the logs used for support and audit purposes. Sensitive fields such as identity documents are stored with additional access restrictions, and only the teams that need them for verification or compliance can reach them.

3. Fraud and phishing protection

We communicate with you from a small, known set of channels: this domain, our official support address, and in-platform messages. Any message that urges immediate action, asks for your password or a verification code, or invites you to a look-alike domain is not from us. Before entering credentials, check the address bar: our pages are served from sabiotrade-ai.com and nothing else.

Verified messages from the platform can carry a personal security code that you set in your profile, which helps you distinguish genuine communications from imitations. If you suspect a cloned website or an approach misusing our name, do not share any personal information and tell us at once; our Fraud warning page describes the patterns we have seen and what to check.

4. Login notifications

When your account is accessed from a device or browser we have not seen before, you receive an email alert with the time and rough location of the attempt. Alerts also fire on certain suspicious patterns, such as repeated failed logins or a password change followed by a withdrawal request from a new device.

Treat every alert as information to check, not noise. If the alert matches your own action, nothing needs doing. If it does not, change your password immediately, review the active sessions described below, and contact support so the account can be protected while you sort it out.

A note on locations: the approximate location in an alert reflects where your internet provider or mobile network connects to the wider internet, which can be a different city from where you are sitting. A login alert from a surprising city is not by itself proof of an intrusion; a login you cannot match to any of your own devices is the signal that matters.

5. Devices and sessions

Your profile shows the sessions currently signed in to your account: browser, device type, approximate location and the time of the most recent activity. Any session you do not recognise can be ended with one action, which signs that device out everywhere on the platform.

Sessions expire automatically after a period of inactivity, and some sensitive actions, such as changing withdrawal details, ask you to confirm your identity again regardless of how recently you signed in. For extra caution on shared computers, sign out manually when you finish rather than relying on timeouts.

A practical habit worth forming early: after any trip where you signed in from a hotel business centre, a borrowed laptop or a public terminal, open the sessions list on your return and clear everything except the devices you own. It takes seconds and removes the one scenario where convenience quietly becomes exposure.

6. Account recovery

Recovering access to an account starts with identity verification, not with a reset link sent to whichever email address happens to be on file. You contact support, provide the information needed to match you to the account and, where required, confirm details from your original verification. Only then is access restored.

This process has limits by design: if the information available cannot establish that you are the account holder, access stays blocked until it can. That is slower and safer than the alternative. Never share your verification documents with anyone who contacts you first, no matter how plausible the story sounds.

7. API key permissions

Connections between the platform and external exchanges are made with keys whose permissions are limited to what the connection needs. The standard scope for automated trading allows reading market data and placing or closing orders. Withdrawal capability is a separate permission that we do not require for the platform to operate, and keys without it cannot move funds out of an exchange regardless of what else they can do.

You can review the connections associated with your account in your profile, see the scope each one carries and remove any that are no longer needed. If you create or manage keys yourself anywhere in your setup, apply the same principle: minimum permissions, and rotation whenever exposure is suspected.

Keys are also where user error does the most damage, so two rules of thumb help. Never paste a key into a chat, an email or a document that syncs to the cloud, and never enter platform credentials on a page you reached by clicking a link in an unexpected message. Navigate to the site yourself instead; the extra ten seconds is the cheapest security control you will ever apply.

8. Audit history

Important events on your account are recorded in an audit log you can read: sign-ins and sign-outs, new devices and browsers, changes to strategies and settings, connections established or removed, and withdrawal requests. Each entry carries a timestamp.

The log serves two purposes. Day to day, it lets you answer the question "what happened here?" without relying on memory. If something is ever wrong, it gives you and our support team a shared, factual timeline to work from, which shortens investigations and reduces guesswork.

9. Support during incidents

If you notice unrecognised activity, a session you cannot explain or a message that worries you, contact support at [email protected] and say so explicitly. As a first step you can freeze your account from your profile, which blocks trading and withdrawals while the review proceeds; you can also end all sessions and change your password yourself.

Incident reports are handled by the Client Support & Compliance team during support hours (Monday to Friday, 8:00 am to 6:00 pm AEST), and credible account-security reports receive priority handling. You will hear from us with an acknowledgement, then with findings and any action taken. For the broader risks of trading itself, read the Risk disclosure; for identity verification, the AML / KYC policy explains what we check and why.