Two-factor authentication
Google Authenticator–compatible TOTP via Web Crypto (RFC 6238). Backup codes generated at setup. Withdrawals, swaps, and sends can require a valid code.
Trust
Security you can see while you trade
Two-factor sign-in, identity checks, and escrow that does not release crypto until payment is confirmed.
KYC verification
Multi-step identity flow with document upload, selfie capture, and admin review queue. Approved tier updates user session and badges across the app.
P2P escrow
Trades move through in-progress, awaiting release, completed, and disputed states. Vendors release crypto only after payment proof; admins can resolve disputes.
Account controls
Staff can freeze an account or change its limits. A frozen account cannot start a new P2P trade.
Session management
Signing out ends the session on every desk: customer, vendor, and staff.
What we check
HTTPS, server-side checks, and rate limits on sign-in. Secrets stay on the server, not in the browser.