Security at Cerfina
Security on a trading platform is not one feature; it is a set of habits, systems and fallbacks that work together. This page describes each layer on your account, how to use it and what to expect from our side if something goes wrong.
Two-factor authentication
Optional but strongly recommended, supported by any time-based authenticator app.
Encrypted everywhere
TLS in transit, encryption at rest on every system holding account data.
1. Two-factor and multi-factor authentication
Every account can enable two-factor authentication (2FA) using a time-based one-time password from an authenticator app such as those built into modern phones or standalone apps. With 2FA on, a stolen password alone is not enough to sign in: the attacker also needs the rotating code from your device, which changes every thirty seconds.
Enabling 2FA takes about a minute from your profile settings and is free. It is optional because we do not force settings on customers, but our strong recommendation is to treat it as mandatory. If you lose your device, recovery is handled by the support team with identity verification: you will be asked questions and for documents that only the account holder can answer and provide, and the process deliberately takes time rather than being instant. That delay is a feature, not friction.
2. Encryption
Data is encrypted in two states. In transit, all connections to Cerfina systems use TLS, so passwords, identity documents and session traffic cannot be read while they travel between your device and our servers. At rest, databases and document stores holding personal and account information are encrypted, so a physical disk or backup removed from our control does not expose readable data.
The scope covers the account platform, the identity verification pipeline and the audit log. Responsibility is split clearly: the platform team owns the keys and rotation schedule for account data, and access to decryption credentials is limited to the specific systems that need it, with each access recorded. Documents you upload for verification are stored in an isolated service with its own access rules rather than in general file storage.
3. Fraud and phishing protection
The only genuine Cerfina domain is the one you are reading now, and we publish that fact so it is easy to check. Emails from us come from our own domain, never from look-alike addresses or free mailbox providers. When we contact you, messages reference your first name and the general topic, and we never include links that ask you to re-enter a password as a matter of urgency.
For high-sensitivity actions, support agents confirm your identity with a protective code that you set yourself in the profile settings before discussing account specifics. If someone contacts you claiming to be from Cerfina and asks for your password, an authenticator code, or remote access to your device, they are not from Cerfina. End the conversation and forward the details to our support address; the Fraud Warning page lists current known scam patterns.
4. Login alerts
You receive an email alert whenever a new device signs in to your account for the first time, and push-style notifications are being rolled out for accounts that opt in. Alerts include the approximate location and device type, which is enough for you to recognise your own actions and spot ones you did not take.
Suspicious activity, such as repeated failed password attempts or a login from an unusual country, triggers an automatic temporary lock and a message to your registered email. If an alert ever shows activity you do not recognise, use the link in the alert to lock the account immediately and contact support; a locked account can be recovered by the legitimate owner through verification, so it is always better to lock first and ask questions second.
5. Device and session management
The security section of your profile lists every active session: browser sessions on desktop, the mobile app and API connections. Each entry shows the device type, when it last connected and its approximate location. You can end any session instantly, which signs that device out and invalidates its credentials without touching your other devices.
Sessions expire automatically after a period of inactivity, and changing your password invalidates all sessions everywhere. Access for exchange API keys can be revoked from the same screen. If you lose a laptop or phone, ending its session from another device is the fastest containment step, followed by a password change and, if the device had your authenticator, 2FA re-enrolment with the support team.
6. Account recovery
Recovering an account starts with identity verification: the support team will ask for government-issued photo identification and, in most cases, a live selfie match against that document to rule out stolen paperwork. Additional questions about account history may be used for high-value accounts. These steps exist so that an attacker who knows your name and email still cannot take the account over.
Recovery deliberately excludes some paths: we do not restore 2FA over a phone call alone, and we do not accept notarised letters in place of the standard document checks. Expect the process to take at least one working day. While a recovery is in progress, withdrawals from the account are held, which protects you during the one window when credentials may be in flux.
7. API key rights
Exchange connections use API keys with scoped permissions, and the platform requests only the scopes a connection genuinely needs. Read permission allows market data and balance queries. Trade permission allows the engine to open and close positions. Withdrawal permission is the highest-risk scope and is treated accordingly: where an exchange supports it, withdrawals initiated through the platform are routed through additional confirmation steps.
You can see exactly which permissions each connected key carries on the connections page, and revoke or regenerate any key at any time. Our standing advice is to create dedicated keys for the platform rather than reusing keys you also paste into other tools, so that a leak on one service never becomes a problem on another. Revoking a key takes effect immediately.
8. Audit history
Every security-relevant event on your account is recorded: logins and failed login attempts, devices added and removed, 2FA changes, API key creation and revocation, and every change to strategy settings or allocation. Entries cannot be edited or deleted, including by our staff, and the log is available to you in the dashboard with timestamps.
The same discipline applies on our side: staff access to customer accounts is logged and reviewed, and access is granted per role rather than broadly. If you ever need to demonstrate what happened on your account, for a tax query or a dispute, the audit history is the authoritative record and can be exported on request through support.
9. Incident support
If you suspect your account is compromised, the fastest channel is the security option in your message to [email protected], which routes to the on-call team. State plainly what you observed and when. As a first step you should end suspicious sessions and change your password if you can still sign in; if you cannot, say so and the team will lock the account on your behalf.
Confirmed incidents follow a defined sequence: the account is frozen, withdrawals are held, access is reset through verification, and a member of the team walks you through what happened and what changed as a result. You will not be left to interpret a security event alone, and escalations go to the security lead with a response expectation measured in hours, not days, during support hours.