Security
Your account is protected by layered controls: strong authentication, encryption in transit and at rest, continuous monitoring and a full audit trail. This page explains each layer, what it does for you and what you should do yourself. Security is a joint effort, and the strongest platform control is weakened by a reused password.
1. Two-factor authentication
Two-factor authentication (2FA, also called multi-factor authentication) is available on every account and can be switched on in your dashboard settings. With 2FA active, signing in from a new device requires both your password and a one-time code from an authenticator app, so a stolen password alone is not enough to reach your account. We support time-based one-time passcode apps as the primary method.
2FA is optional but strongly recommended, and we encourage enabling it before your first deposit. If you lose access to your device, recovery is handled by the support team through identity verification; see point 6 for how that works and what it deliberately does not allow.
2. Encryption
All traffic between your browser and the platform is encrypted with TLS, and personal data held at rest is encrypted on our storage layer. Encryption applies to account details, identity-verification documents and support correspondence alike. Access to the systems that hold this data is restricted to named staff, granted per role, and every access attempt is logged.
Keys and credentials are managed separately from the data they protect, and rotation is scheduled rather than left to memory. The practical effect for you: even a compromised backup does not hand over readable personal data.
3. Protection from fraud and phishing
Our official domain is gruviona.org, and messages from the platform are sent from addresses ending in @gruviona.org. We will never ask you for your password, your 2FA codes or remote access to your device, and we will never ask you to move money to a "safe account", a phrase fraudsters favour because it sounds official. Every account can set a personal protective code word with your manager, which our staff quote back to you when they call, so you can verify an inbound call is genuinely ours.
If a message or site looks almost right, treat the difference as the point: clone firms rely on addresses one character away from the real one. The fraud warning page lists what we do and do not do, and how to report a suspected clone immediately.
4. Login notifications
You are notified by email whenever a login happens from a device your account has not used before, and when activity on your account looks suspicious, such as repeated failed sign-in attempts or a change to your withdrawal details. Notifications state the device type, the approximate location and the time, so you can compare them with what you actually did.
These alerts are informational, not a request: no genuine alert will ever ask you to reply with credentials. If a login you do not recognise appears, change your password, review active sessions (point 5) and contact support the same day.
5. Managing devices and sessions
Your dashboard shows every active session, with device, browser, location and last activity. You can end any session instantly, which signs that device out and invalidates its session token, or sign out everywhere at once if you have lost a device. Sessions end automatically after a period of inactivity, so an abandoned tab in a library does not stay live indefinitely.
Make a habit of checking the session list after travel, after lending a device to anyone, and after any alert from point 4. Removing an unknown session takes one click and costs nothing if it turns out to have been your own new phone.
6. Account recovery
Recovering an account, whether after a lost device or a suspected compromise, always goes through the support team and always includes identity verification against the documents you provided at registration. Recovery cannot be completed by email alone, and there is deliberately no automated "reset everything" link, because that link is exactly what an attacker would want.
Expect to answer questions about your account history and to wait while checks are completed; a careful recovery is slower on purpose. Once identity is confirmed, support can disable lost 2FA devices, force a password reset and clear foreign sessions before you sign in again.
7. API key permissions
Where the platform connects to an exchange on your behalf, it does so with API keys whose permissions you control: read-only keys can view data, trading keys can open and close positions, and withdrawal permissions exist as a separate scope that platform keys do not need and that you should not grant. Least privilege is the rule: give a key the narrowest scope that does its job, and delete keys you no longer use.
Key creation and revocation happen inside your account settings and are recorded in the audit history. If you are unsure which scopes a strategy needs, ask your personal manager before creating anything; guessing wide "just in case" is how small incidents become large ones.
8. Audit history
Every security-relevant action on your account is written to an audit log you can open yourself: logins and failed attempts, session changes, strategy switches, settings edits, API key events and withdrawal requests, each with a timestamp. The audit view is the honest record of what happened, independent of what anyone remembers.
Use it the way an accountant uses a ledger: check it routinely, not only after a problem, and download a copy when reconciling your own records. If an entry puzzles you, quote it to support by date and time, which is far faster than describing it.
9. Support during incidents
If something goes wrong, one channel, one procedure, no improvisation.
Security incidents are handled by Client Support & Compliance through a single channel: [email protected]. Write with "Security" in the subject line and you will be connected to the incident team. The first request in any suspected compromise is to secure the account: we can freeze logins, block pending withdrawals and lock strategy changes while the facts are established.
Expect an acknowledgement quickly during opening hours (Monday to Friday, 9:00–17:30 GMT/BST (excluding public holidays)), then a structured follow-up: what we see on our side, what we have done, and what we need from you. Communication continues in writing, so there is a record both sides can rely on. If the incident involves suspected criminal activity, we will tell you plainly and support your report to the relevant authorities, including Action Fraud in the United Kingdom.
After any incident, do three things before resuming normal use: change your password, re-enable 2FA on a clean device, and review the audit history together with support so the entry that started it is understood. Prevention afterwards matters as much as response during.