Nine layers between your account and everyone else
Security at Fexenvance is not a single wall, it is a series of doors, each with its own lock and its own alarm. This page explains all nine layers in plain English: what each one protects, how to switch it on where it is optional, and exactly what to do if something ever looks wrong. Read it once before your first deposit and you will know precisely how your account is guarded.
1. Two-factor authentication
2. Encryption in transit and at rest
3. Anti-fraud and phishing defence
4. Login and activity alerts
5. Devices and session management
6. Account recovery
7. API key permissions
8. Audit history
9. Incident support
1. Two-factor authentication
Two-factor authentication (2FA) adds a second lock to your login: after your password, you approve the sign-in with a one-time code generated on your phone. We support authenticator applications and, on compatible devices, passkey approval. A password alone, however strong, can be phished, reused or leaked from another site, and a one-time code that expires within thirty seconds cannot be replayed.
2FA is optional at registration but strongly recommended, and it becomes mandatory before certain sensitive actions, including first-time withdrawals to a new destination and changes to your contact details. If you lose your device, recovery is handled through verified identity checks described in section 6, never through a code sent to a number you have just changed. Our support staff will never ask you to read a one-time code aloud or forward one to them.
2. Encryption
All traffic between your device and the platform is encrypted with TLS; you should always see the padlock and an address beginning with https. Data at rest, including the identity documents you upload for verification, is encrypted at storage level across every system that holds it, with key management separated from the systems that use the keys.
Encryption applies to more than the website. Backups, internal transfers between the platform and its executing partners, and the exports our compliance team produces for regulators all travel through encrypted channels. Card details are never stored on our systems at all: deposits are handled entirely by the payment providers, which is why nobody at Fexenvance can ever read your full card number.
3. Protection from fraud and phishing
Our official domain is fexenvance.org, and every message we send comes from an @fexenvance.org address or is visible inside the platform's own message centre. We publish this precisely because fraudsters clone brands: see our fraud warning page for the current list of ways to verify you are dealing with us and not an impostor.
Protective messages that carry account information include a personal security phrase you choose at registration, so you can confirm a caller genuinely represents us before you discuss anything. We will never telephone you to ask for your password, a one-time code, or remote access to your device, and we will never pressure you to move money to a "safe account". Any request of that kind is fraud by definition, whatever number it appears to come from.
4. Login alerts
Every login from a device your account has not seen before triggers an immediate alert by e-mail, and for accounts with 2FA enabled, a push notification. The alert tells you the country, the approximate location, the browser and the time, which is usually enough for you to recognise your own new phone or flag a stranger within seconds.
Suspicious activity, such as several failed password attempts, a login from an unusual country at an unusual hour, or a change to your withdrawal details followed by a payout request, is flagged to our monitoring team and to you. Where the pattern looks like an account takeover attempt, withdrawals are held automatically until you confirm them, because a delayed legitimate withdrawal is an inconvenience and a fraudulent one is a disaster.
5. Managing devices and sessions
The security page of your dashboard lists every active session: the device, the network, the time it began and when it was last used. You can end any of them with one click, and signing out on a lost device takes effect immediately, not at the next page load.
Sessions expire automatically after a period of inactivity, and logging in on a new device after a password change retires the old tokens everywhere else. If you sell or lose a phone, one message to support from your registered e-mail can freeze all sessions at once, buying you time to change credentials calmly rather than in a panic.
6. Account recovery
Recovering access after a lost password or a lost device always involves a verified identity check, never a simple e-mail loop. We ask for information only the account holder should know, compare a fresh identity document against the one from onboarding, and, for high-value accounts, confirm by a call to the registered number before anything is reset.
Recovery requests are handled only by the support and compliance teams, are logged in full, and are deliberately slower than login for the same reason bank counters ask questions: the small friction is what protects the balance. If you are ever locked out, contact [email protected] from your registered address and expect the process to take a working day rather than a minute. That is the system working, not failing.
7. API key permissions
Where the platform connects to a venue on your behalf, access is granted through keys with the narrowest possible rights. The engine needs to read positions and place trades; it does not need withdrawal rights, and withdrawal capability is never granted to an automated key on any account.
Keys are stored encrypted, scoped to the functions the engine actually uses, and rotated on a fixed schedule. If a key is ever compromised, its blast radius is limited to trading within the limits you have set, and revoking it takes effect within moments. You can ask your personal manager at any time to confirm which permissions are active for your account and when they were last changed.
8. Audit history
Every security-relevant event on your account lands in an audit trail you can read yourself: logins and where they came from, connections and disconnections of venues, changes to strategies and their parameters, and every amendment to your personal or withdrawal details, each line stamped with the time and the device responsible.
The audit trail serves two purposes. For you, it is proof: if a setting changed, the trail shows when and from where, so disputes can be settled with records rather than recollections. For us, it is an obligation: UK record-keeping requirements mean the logs are retained to regulatory standards and can be produced for a supervisory review or, where the law requires it, for law enforcement, exactly as described in our Privacy Policy.
9. Support during incidents
If anything looks wrong, a message to [email protected] marked "security" opens an incident with the compliance desk the same working day. The first step, where there is any suspicion at all, is a protective freeze of withdrawals: your money staying put for an hour is the safest default while facts are established.
Incidents follow a fixed sequence: acknowledgement within one working hour, a named case handler, a plain-language update at least daily until resolution, and a written summary at the end covering what happened, what was affected and what has changed to prevent a repeat. Suspected crime is reported to the relevant authorities, and we support clients in reporting to Action Fraud where appropriate. You will never be left interpreting silence, because silence is the one thing an incident never needs.