Account and platform security

1. Multi-factor authentication

Enable an authenticator application where available and store recovery codes away from the device used to sign in. SMS may be offered as a fallback, but number-transfer attacks make an authenticator a stronger option.

Support will verify identity before changing an authentication method. Staff will never ask for your password, current one-time code or complete recovery code.

2. Encryption

Supported web connections use transport encryption to reduce interception between the browser and service. Sensitive account records are protected at rest through access restrictions and encryption appropriate to the system.

Encryption does not protect information after a user shares it with an impersonator or leaves an unlocked device unattended. Device security remains important.

3. Fraud and phishing protection

Use only https://capital-asverix.ca and check the address before entering credentials. Treat messages that promise guaranteed returns, demand remote-device access or require payment to release a withdrawal as suspicious.

Official support uses [email protected]. A matching display name alone is not proof of origin; inspect the complete sender address.

4. Login notifications

Email or in-product alerts may identify a sign-in from a new device or unusual activity. Review the time, approximate location and device information promptly.

If you do not recognize an event, change the password from a trusted device, end active sessions and contact support. Do not respond through the suspicious message.

5. Devices and sessions

The account view can show active sessions and permit access to be revoked. Automatic timeouts reduce exposure on unattended devices, while sensitive changes may require renewed authentication.

Remove devices you no longer use. Avoid public computers and shared browser profiles for financial accounts.

6. Account recovery

Recovery can require verified contact access, identity evidence and a review of recent account information. These steps protect against social-engineering attempts and may take longer than a simple password reset.

During review, certain account functions may be restricted. Support explains the process but cannot bypass required evidence.

7. API permissions

Where account connections use API keys, grant only the permissions required for the intended function. Read or trading access should remain separate from withdrawal authority whenever the provider supports that distinction.

Never send a key through ordinary email. Revoke a key that was exposed, generated on an unfamiliar device or no longer needed.

8. Audit history

Account records may include sign-ins, connections, setting changes and strategy adjustments. Reviewing this history can help distinguish an expected configuration change from unauthorized activity.

Record the time and details of a suspicious event before making extensive changes. That information can support an investigation.

9. Incident support

Contact [email protected] immediately for suspected unauthorized access. Include your name, the approximate event time and a description, but never a password or one-time code.

Support can restrict access, route the case for investigation and provide status updates. Critical steps are prioritized, but investigation timing depends on the evidence and any third-party provider involved.