Security: how we protect your account and your data
Nine working controls stand between your account and the people who should not reach it. This page explains each one in plain terms: what it does, when it applies and what you should do if something looks wrong. Security at Brunevo is a set of behaviours we practise daily, not a paragraph written for regulators, and it stays consistent with the summary you may have read on the homepage.
2FA and MFA
Optional today, recommended always, with a recovery path that verifies you rather than quizzes you.
Encryption
Protection for data in transit and at rest across every system that carries account details.
Login alerts
Notifications for new devices and suspicious activity, delivered where you will actually see them.
Audit history
A searchable record of sign-ins, connections and every change made to your settings.
01 2FA / MFA: supported methods, when it applies and how recovery works
Two-factor authentication can be enabled from the security section of your dashboard. We support authenticator apps generating time-based codes, and email one-time codes as a fallback for devices where an app is impractical. Enabling 2FA is optional, but we recommend it for every account: it is the single change that makes a stolen password almost useless to an attacker.
If you lose access to your second factor, recovery does not rely on remembering old passwords. You confirm your identity through the verification steps described in section 6 of this page, after which support removes the old 2FA binding so you can register a new one. Until that check completes, no withdrawal can be initiated from the account, which is deliberate friction working in your favour.
02 Encryption: data at rest, data in transit and where each applies
Data moving between your browser and our platform travels over TLS, as does every connection between the platform and the exchanges and payment providers we integrate with. Data at rest, including account records and the personal details collected during verification, is encrypted on the storage layer of the systems that hold it.
Encryption applies across the environments that matter: the account platform itself, the verification pipeline that handles identity documents, and the backup copies of both. Encryption is a floor, not a finish line, which is why access to the systems that hold decrypted data is limited to the specific teams whose work requires it and is logged in the audit history described below.
03 Fraud and phishing protection: official domains and verified messages
We communicate with users from our own domain, brunevo-ai.com, and from the support address [email protected]. Messages that ask you to click a link to unlock funds, re-enter a password or confirm card details should be treated as hostile regardless of how familiar the sender looks. We will never ask you for your password, your full card number or a one-time code over the phone or by email.
Where a message concerns money movement, the account holder can request a protective code: a short phrase we place on your account that any genuine representative will know and repeat back to you. If the caller does not know your protective code, end the conversation and write to [email protected]. Clone firms misuse respected names precisely because it works; our fraud warning page lists the tells.
04 Login notifications: email and push alerts for new devices and suspicious activity
When your account is signed into from a device we have not seen before, you receive an email notification, and where you have the platform app installed, a push notification as well. The same applies to sign-ins from a new country and to password changes. The alerts name the device type, the approximate location and the time, so you can judge in seconds whether it was you.
If activity looks suspicious beyond a new device, such as several failed sign-in attempts followed by a success, or a withdrawal request to details you have never used, the account can be temporarily restricted from trading and withdrawals until you confirm the activity with support. The inconvenience of a short freeze is small next to the alternative.
05 Device and session management: active sessions, revoking access, automatic sign-out
The dashboard lists every active session: browser sessions on desktop and mobile, the app, and any API connections acting on your behalf. Each entry shows when it began and the device behind it, and each can be revoked individually from the same screen. Signing out everywhere is one button and takes effect immediately across all devices.
Sessions that remain idle for an extended period end automatically, and signing in on a new device invalidates session tokens older than the limit you have set. Users who share a household computer should treat the session list as a habit rather than a setting-and-forget page; a quick glance after lending a device to anyone is cheap peace of mind.
06 Account recovery: identity checks, contacting support and the limits of what we will ask
Account recovery starts with identity verification, not with security questions that can be guessed from social profiles. You will be asked to confirm details from your verification record, and in some cases to provide a short live or document-based check mirroring the original KYC process. This is the same standard applied when you opened the account, which is exactly the point.
Recovery requests go through [email protected] and are handled by the team responsible for account security, not by whichever agent picks up first. There are limits to what we will ask for: we never request your password, we never send links that ask you to enter card details, and we never ask for a payment to unlock an account. If someone claiming to be from Brunevo does any of these, it is not us.
07 API key permissions: read, trade and withdraw are three separate rights
Connections between the platform and exchanges operate through API keys, and those keys carry scopes. The engine needs to read market data and, where you have enabled automated execution, to place trades under your strategy settings. Withdrawal rights are a separate scope that the engine does not require and that you should grant only if you have a specific reason to.
Keys can be regenerated and revoked from your dashboard at any time, and revocation takes effect immediately. Treat an exchange API key like a house key: if you no longer remember who has a copy, rotate it. The audit history records every change to key permissions so you can reconstruct what was possible at any point in time.
08 Audit history: sign-ins, connections and every settings change on record
Every security-relevant event on your account lands in the audit history: sign-ins with device and location, connections and disconnections, changes to strategy settings, password and 2FA changes, and requests to alter withdrawal details. The record cannot be edited or deleted from within the account, including by us without a logged support action.
The log exists for two reasons. Day to day, it answers questions like who changed my notification settings on Tuesday. In the rare case of a dispute, it provides a shared, factual timeline that both you and our complaints team can read, which keeps the conversation on evidence rather than memory.
09 Incident support: how to reach us, freezing an account and what happens next
If you suspect your account is compromised, or you simply cannot rule it out, contact [email protected] immediately. The first action available to the security team is a full freeze: trading stops, pending withdrawals halt, and sign-in sessions end. A freeze is reversible in minutes once the situation is clear, so err towards requesting one.
Incidents are escalated in a fixed order: the responding agent secures the account, the security team investigates the event using the audit history, and you receive a summary of what happened and what changed, normally within one working day of the review completing. If the incident involves possible fraud using our name, the fraud warning page explains what to document before you write in.
Security is a joint effort
Three habits that make everything above stronger.
Use a unique password
One password for Brunevo and nowhere else, stored in a password manager rather than a notes app.
Turn on 2FA
It costs a minute to enable and removes most of the value of a leaked credential.
Read your alerts
The notifications only protect you if the strange one gets a second look, not a swipe away.