Security controls you can understand and use

1. Multi-factor authentication

Multi-factor authentication adds a second check after your password. Supported methods may include an authenticator application and verified email or phone prompts, depending on availability during setup. An authenticator app is generally less exposed to phone-number takeover than a text message.

Enable the strongest available method before connecting an account or making a deposit. Store recovery codes offline, never read a one-time code to a caller, and treat an unexpected approval prompt as evidence that someone may know your password.

2. Encryption and data handling

Connections use encrypted transport to reduce interception while information moves between your browser and the service. Sensitive records are protected at rest using access controls and encryption appropriate to the data and operating environment.

Encryption does not protect information after you disclose it to an impostor or use an infected device. Keep your browser and operating system current, use a trusted network, and avoid entering account credentials on shared computers.

3. Fraud and phishing protection

Official pages use the https://capitalasverix.com domain, and support email comes from [email protected]. We do not ask for passwords, one-time codes, private keys, or payment through gift cards and personal accounts. We do not promise guaranteed returns.

Check the full address before signing in. If a message creates unusual urgency, open the site independently instead of using its link. Report suspicious contact with the sender, time, address, and screenshots so the security team can investigate.

4. Sign-in notifications

A new-device or unusual-access notice helps you identify activity you did not initiate. Notices may include the approximate location, device type, and time. Location is derived from network information and can be imprecise, so compare several details.

If the activity is not yours, change your password from a trusted device, revoke other sessions, review account settings, and contact support. Do not approve a prompt simply because a caller claims to be investigating it.

5. Device and session management

The account area may show active sessions and connected devices. Review them after travel, shared-device use, or a password change. Revoke entries you do not recognise and sign out from devices you no longer control.

Sessions can expire automatically after inactivity, but automatic expiry is not a substitute for signing out. Avoid saving passwords in an untrusted browser and lock the device itself with a secure PIN or biometric control.

6. Account recovery

Recovery begins with identity confirmation through the approved support process. You may be asked for information that can be compared with verified account records. Support will not bypass verification merely because a request is urgent.

During recovery, withdrawals or sensitive changes may be restricted while access is investigated. This protects the account but can delay activity. Keep your email and phone details current so you can receive legitimate recovery notices.

7. Connection and API permissions

Where an external market account is connected, use the minimum permission needed. Read access permits data retrieval; trading access may permit orders; withdrawal access can permit movement of funds and should not be granted to an analytical connection unless expressly required and independently understood.

Create separate credentials when the provider supports them, restrict permitted networks where practical, and revoke keys that are no longer used. Never paste a secret key into chat, email, or an unknown support form.

8. Audit history

Account history may record sign-ins, connections, permission changes, strategy settings, and other material actions. The record helps users and support teams reconstruct what happened during a suspected incident or disputed change.

Review history periodically rather than only after a problem. Capture the date and reference for an unfamiliar event and contact support before altering evidence needed for investigation.

9. Incident support

For urgent access concerns, email [email protected] with "Account security" in the subject. State what you observed, when it occurred, and which safe contact method support should use. Do not include your password, one-time code, or full payment-card number.

The response may include session revocation, temporary restrictions, identity verification, and escalation to Client Support & Compliance. We document the event and explain available next steps, but technical investigation cannot guarantee recovery of a completed external transfer.

Asset protection in Canada

Cash deposits with a member institution may be eligible for CDIC coverage, subject to its rules. Eligible securities held by a member investment dealer may be covered by CIPF, subject to its limits. Crypto and other digital assets are generally not covered by CDIC or CIPF.

Eligibility depends on the institution, asset, and account structure. Security controls protect access and information; they are not deposit insurance and do not protect against market loss.

Your security checklist

• Use a unique password stored in a reputable password manager.
• Enable multi-factor authentication and protect recovery codes.
• Review active sessions, notification settings, and connection permissions.
• Verify the site address and official support email before responding.
• Install operating-system and browser updates promptly.
• Contact support immediately after suspicious access or payment instructions.

Secure use on mobile devices

Protect a phone or tablet with a strong device passcode and automatic locking. Install applications only from the official store for the device, review application permissions, and remove software that requests accessibility or screen-control access without a clear reason. A person claiming to be support should never ask you to install remote-control software.

Public wireless networks can expose devices to interception or manipulation. Use a trusted connection for sign-in, verification, and payment activity. If the device is lost, use its remote-lock feature, change the account password from another trusted device, and ask support to revoke active sessions.

Payment-instruction verification

Compare the recipient legal name, destination, currency, and reference with the information in your authenticated account. Treat a sudden change delivered by email, text message, or phone as suspicious until it is independently confirmed through [email protected]. Never send funds to a personal account on the promise that they will later appear in your platform balance.

Keep transaction receipts and non-sensitive references. If a payment instruction appears fraudulent, contact the sending financial institution immediately because recovery options can become more limited over time.

How we assess security events

An investigation can compare sign-in times, device characteristics, approximate network location, session changes, permission changes, and the timing of disputed activity. Approximate location is not exact proof, and a familiar device name is not conclusive, so evidence is assessed together.

Temporary restrictions may remain while identity and control are confirmed. We aim to restore legitimate access promptly, but we will not bypass a meaningful check solely to meet an urgent trading or withdrawal request.