Security
This page describes, point by point, how AfriSynapse protects accounts and personal data, and what you can do yourself. It matches the security summary on our home page and the verification rules described under AML and KYC. Security on a trading platform is a shared effort: we run the technical protections listed below, and the habits in each section's recommendation turn them into real safety.
If something looks wrong right now
Email [email protected] immediately with the subject line "Security concern". Account freeze options can be applied within the incident process described in section 9 below, so a quick report limits damage.
Nine protections, explained
1. Two-factor and multi-factor authentication
We support one-time codes from authenticator apps (TOTP) as the second factor on your login, and we prompt for it again before sensitive actions such as changing your withdrawal details or disabling security features. Two-factor authentication is optional at the account level but strongly recommended for every user, and we ask for it during onboarding. If you lose your device, recovery runs through our support team with identity verification, a cooling-off period and a review of recent account activity, so a stolen phone alone cannot become a stolen account.
Recommendation: enable two-factor authentication on day one and store backup codes on paper, not in your email.
2. Encryption of data in transit and at rest
All traffic between your browser and the platform travels over TLS, and certificates are kept current with modern cipher suites. Personal data held in our systems is encrypted at rest, and encryption keys are managed separately from the data they protect. The scope covers identity documents you upload for verification, contact details and account records. Access to decryption is limited to the specific systems that need it for onboarding, support and compliance, each of which logs its access.
Recommendation: check for the padlock and the correct domain before entering credentials, especially on mobile networks.
3. Anti-fraud and phishing protection
Our official domain is afrisynapse.org, and every operational email we send comes from that domain, never from lookalikes or free mail providers. Messages about your account carry a personal security code that you set during onboarding, so you can verify that a message genuinely comes from us. We never ask for your password, your two-factor codes, or remote access to your device, and we never pressure you to move money quickly. The Fraud Warning page lists the impersonation patterns we have seen, including cloned sites and fake support accounts on social media.
Recommendation: treat any message that asks for credentials, codes or urgency as fraudulent, and report it to us before acting.
4. Login and activity notifications
When a login happens from a device or browser your account has not used before, you receive an email notification with the time, approximate location and device type. The same applies to suspicious activity patterns, such as password changes, new withdrawal destinations or API connections being added. Notifications are informational and fast; they are not a substitute for two-factor authentication, but they give you an early signal that something deserves a closer look.
Recommendation: read these emails even when you expect the login, and act immediately when you do not.
5. Device and session management
Your security settings show every active session, with device, browser and last-seen information, and you can revoke any session instantly without waiting for it to expire. Sessions end automatically after a period of inactivity, and logins from new countries can require re-authentication. If you lose a laptop or sell a phone, revoking its session takes one click and cuts that device off completely.
Recommendation: review the session list monthly and after any travel, and revoke anything you do not recognise.
6. Account recovery
Recovering access to a locked account requires proof that you are the account owner: identity verification against the documents from onboarding, confirmation of recent account activity, and contact from details already on file. This is deliberately slower than a password reset. During recovery we freeze withdrawal functionality as a precaution, and there is a defined waiting period before sensitive changes take effect. These frictions exist because the alternative, an easy reset, is exactly what an attacker wants.
Recommendation: start recovery only through [email protected], and be suspicious of anyone offering a faster route.
7. API key permissions
Connections to exchanges run on keys with three possible scopes: reading account data, trading, and withdrawing. AfriSynapse requests only read and trade scopes; withdrawal scope is never requested, and you should refuse any integration, ours included, that asks for it. Keys are stored encrypted, scoped to the minimum set of functions, and can be revoked by you at any time from either side of the connection. If a key needs to be replaced, the old one is disabled first so there is no window of dual validity.
Recommendation: create keys only on the exchange's official site, restrict them to trade, and rotate them if you ever suspect exposure.
8. Audit history
Every security-relevant event on your account is recorded in an audit log you can read yourself: logins and their devices, API connections added or removed, changes to strategies, settings and personal details, and withdrawal requests. Entries cannot be edited or removed from your side or, by policy, from ours. The log is the authoritative record when something needs investigating, and it is the first thing our support team consults when you report unusual activity.
Recommendation: glance through the audit history whenever you receive a notification you did not expect.
9. Support during incidents
If you suspect a breach, one email to [email protected] opens an incident: your account can be frozen while the audit history is reviewed, recent instructions are checked, and credentials or keys are rotated as needed. You receive a named handler, updates at agreed intervals, and a summary of findings and remediation at the end. Suspicious events can also be escalated through the complaints procedure if you are unhappy with how an incident was handled, including the external escalation route described there.
Recommendation: report first and investigate second; a false alarm costs minutes, while a delayed report can cost the account.
Related protections elsewhere on the site
Account security works together with the verification process described on the AML and KYC page, which is what stops stolen identities from reaching the platform in the first place, and with the Risk Disclosure, which covers the market-side risks no security feature can offset. For how your data is stored and which rights you have over it, see the Privacy Policy. If you have spotted a website or message misusing our name, the Fraud Warning page explains what to check and how to report it.