Security
How we protect your account and data, and what you can do to stay safe.
Signing in
Passwords are stored as one-way hashes. You can turn on two-step sign-in with an authenticator app, and keep recovery codes in case you lose your phone. After several wrong attempts we ask a security question, and sessions end after a period without activity.
Approvals by a second person
Changes that move money or change prices, credit or rules need a second person to approve them. The person who asked can never approve their own request.
Records of what happens
Staff actions are written to an audit log, and every sign-in is recorded with its time and device.
What you can do
Use a password you don't use anywhere else, turn on two-step sign-in and sign out on shared computers. We will never ask for your password, PIN or sign-in codes. If something looks wrong, tell us.