Security of your account
Your Ptozmalquix AI account holds money, personal information and trading history, which makes it an attractive target. This page explains, section by section, how the account is protected and, more importantly, which habits protect you. Read it once when you register and again whenever anything about your account feels unfamiliar.
1. Two-factor authentication (2FA and MFA)
Two-factor authentication requires a second proof of identity in addition to your password, so a stolen password on its own is not enough to sign in. Enabling 2FA is optional, but we recommend it for every account without reservation, because it defeats the most common form of unauthorised access at almost no cost to you.
Authenticator app
A time-based code generated by an authenticator application on your phone. This is the strongest method we support, because the codes are produced on your device, are never transmitted in advance and expire within seconds.
Email one-time code
A single-use code sent to your registered email address. It is convenient and still considerably stronger than a password alone, provided your email account is itself protected by a strong, unique password.
Recovery through support
If you lose access to your second factor, the recovery team can help once your identity has been verified. Expect document checks and questions about recent activity; that friction is deliberate and works in your favour.
2. Encryption of your data
Everything you exchange with the platform travels over encrypted TLS connections, so it cannot be read in transit by third parties on your network. Personal information, including your name, contact details and identity documents, is encrypted when stored. Trading data, such as positions, orders and performance reports, sits in systems separate from the document store, and each system is reachable only by the staff whose roles require it.
The practical consequence is that no single system exposes your complete profile, and every access is logged and reviewable. Encryption does not replace caution on your side, so pair it with a unique password and 2FA for the strongest overall position.
3. Fraud and phishing protection
Most attacks on trading accounts arrive dressed as official communications: a counterfeit security alert, an urgent withdrawal confirmation, a caller claiming to represent support. Once you know how our genuine messages behave, the imitations become easy to separate.
One official domain
Our website is served only at ptozmalquixai-app.com. Any other address presenting itself as Ptozmalquix AI, however convincing the resemblance, belongs to someone else, so type the address yourself instead of following links.
Verified messages
Emails from us concern activity on your account, such as sign-ins, withdrawals or verification, and never demand action within minutes. When a message manufactures panic, treat the panic itself as the warning sign.
We never ask for secrets
No genuine member of Ptozmalquix AI staff will ever ask for your password, your one-time codes or your full card number by phone, email or chat. Anyone who does is committing fraud, and you should end the contact at once.
4. Login notifications
When your account is accessed from a new device, browser or location, we send an email to your registered address. Comparable alerts are raised by activity that looks out of character, so a problem you did not cause announces itself rather than staying quiet.
New device alerts
Every sign-in from an unrecognised device, browser or region produces an email describing what connected and when. A single glance confirms whether the entry was yours.
Suspicious activity alerts
Repeated failed sign-in attempts and changes to security settings also generate notifications. These messages are informational by design and take seconds to read.
How to react
If the alert describes something you did, no action is needed. If it does not, change your password, end all active sessions and contact support so the account can be frozen while the incident is examined.
5. Device and session management
Your account keeps a record of every place you are signed in, and you control that footprint from the security settings. Reviewing it occasionally takes less time than making tea and catches problems that password changes alone would not.
Active sessions list
Inspect each signed-in device with its browser type, approximate location and time of sign-in. An unfamiliar device on this list deserves the same response as a login notification you did not cause.
Remote sign-out
Signed in on a shared or public computer and unable to return to it? End that session remotely. Signing out everywhere at once is also the recommended first step after losing a phone or laptop.
Automatic session expiry
Sessions lapse automatically after a period of inactivity, so an abandoned browser window does not remain open to your account indefinitely. Expiry protects you silently, but signing out yourself remains the cleaner habit.
6. Account recovery
Recovery begins with identity verification, because the only outcome worse than losing access to your account is a stranger gaining it by pretending to be you. Contact support from your registered email address, be prepared to confirm personal details and recent account activity, and follow the instructions you are given rather than improvising. Security-sensitive changes, such as replacing a lost second factor, changing your email address or updating withdrawal details, are held for a defined waiting period so that a hijacker cannot redirect your money in one quick conversation.
The waiting period can feel slow when you are the legitimate owner, and it exists precisely for the moments when the person asking is not. If any part of a recovery conversation feels rushed or off-script, stop and write to us directly at [email protected].
7. API key permissions
API keys connect tools to your account, and each key carries permissions that determine what its holder can do. Permissions are separated into distinct scopes so that a key never conveys more power than its purpose requires.
Read-only
Allows a tool to view balances, positions and history without being able to alter anything. This scope suits portfolio trackers and reporting tools, and it is the safest default.
Trading
Allows a tool to place, modify and close orders. Grant it only to services you have positive reason to trust, and check what such tools have done at least weekly.
Withdrawal
The most sensitive scope, permitting the movement of funds off the platform. Our advice is straightforward: do not enable it unless a specific, understood need exists, and remove the key once that need has passed.
The governing principle is least privilege: grant the minimum scope, delete keys you no longer use, and rotate any key you suspect has been exposed, however briefly.
8. Audit history
Security-relevant events on your account are recorded: sign-ins, new devices, API connections, strategy changes and updates to your settings. This audit history is visible to you in the account area, which turns it from an internal log into a practical instrument. After any security alert, the audit trail tells you what actually happened and when, so your response rests on facts rather than alarm.
Make a point of scanning recent entries when you review your weekly reports. Entries you cannot explain are the earliest visible symptom of a problem, and reporting one promptly keeps a small incident small.
9. Incident support
If you suspect unauthorised access, a phishing attempt or any other security incident, the fastest route is email: write to [email protected] from your registered address and describe what happened. Three things follow, in a predictable order.
Report the incident
Give the times, the messages that reached you and any steps already taken, a password change for instance. The sharper your report, the quicker the team can piece events back together.
Account freeze
On request, support can place a freeze on the account while the incident is reviewed. The freeze halts activity without closing anything permanently, which holds funds still while the facts are established.
Escalation and updates
You first receive confirmation that the report arrived, then guidance on immediate protective steps, and finally a summary of the outcome once the review closes, in that order.
Incidents are handled by the Client Support & Compliance team during support hours, which are Monday to Friday, 09:00 to 18:00 UK time (excluding bank holidays). When in doubt, report anyway: a false alarm costs minutes, while an unreported incident can cost a great deal more.
Security is a shared responsibility. We protect the platform, its systems and its data; you protect your password, your second factor and your scepticism toward unexpected messages. Trading carries risk, including loss of capital, and account security is the one part of that risk you can directly control.