Document / SEC-09

How Matrix Edge protects your account

Security here is a stack of specific, working controls rather than a slogan. This page describes each layer in plain terms: what it does, what we manage for you, and what stays in your hands. For identity verification policy specifically, see the AML / KYC page.

1. Two-factor authentication (2FA/MFA)

Matrix Edge supports time-based one-time passcode apps as the second factor on your login, which is the method we recommend for every account. A second factor is optional at the Basic service level and strongly encouraged; your personal manager will walk you through pairing an authenticator app during setup so it takes minutes, not a support ticket. Passcodes refresh every thirty seconds, and the platform asks for one whenever you sign in from an unrecognised device.

If you lose the device holding your authenticator, recovery is deliberately manual: you contact support from your registered email, verify your identity through the documented checks described in section 6, and a controlled reset is performed. This friction is intentional. Instant self-service 2FA resets would undo most of the protection the second factor provides.

2. Encryption of data

Data in transit between your browser and the platform is protected with TLS, and connections are enforced over HTTPS. Within the environment, passwords are stored only as salted hashes, never in readable form, and payment credentials are handled by the payment providers rather than stored on our systems. When you fund an account by LINX or card, the platform never sees your full card number.

Stored records, including the KYC documents described on the AML / KYC page, sit in encrypted storage with access limited to the compliance and support roles that operationally require it. Every access to a client record is logged, and those logs are reviewed as part of routine housekeeping rather than only after incidents.

3. Fraud and phishing protection

Our official domain is matrix-edge.org, and email sent by the platform originates from the matrix-edge.org domain only. When we write to you about your account, the message includes the first characters of your registered email as a protective code, so you can confirm the message was generated from records that actually know your account. Be cautious of any message that lacks it.

We are aware of attempts to misuse our name in fraudulent schemes, and we maintain a standing Fraud warning page describing known clone patterns. Support will never ask for your password, your one-time passcode, or remote access to your device. If a caller or website claiming to represent Matrix Edge does any of those things, end the contact and tell us at [email protected].

4. Login and activity notifications

The platform sends an email alert whenever a new device signs in to your account for the first time, and a further alert when activity patterns look unusual, such as a password change followed immediately by a withdrawal request from a different location. Alerts state what happened and from which approximate location, never with a link that asks you to re-enter credentials.

These notifications exist so you hear about access issues within minutes. Keep them switched on even if they occasionally feel noisy, because disabling them removes the earliest warning you would get. If an alert ever describes something you did not do, contact support immediately and we will freeze pending withdrawals while the case is examined.

5. Device and session management

Your account settings show every active session: device type, browser, approximate location and sign-in time. You can end any session remotely, which is useful when a phone or laptop is lost, and you can sign out everywhere at once when you want a clean slate. Sessions opened on shared computers expire automatically after a period of inactivity.

Automatic expiry also applies to the connections used for automated trading: exchange API sessions are refreshed on a schedule and revoked when they exceed their intended lifetime. The effect is that a key you forgot about cannot keep running quietly forever; anything active is either in use or deliberately kept.

6. Account recovery

Recovering an account starts with identity verification, not with a password reset link. You contact support from your registered email and provide the identity documents described in our AML / KYC procedures; where warranted, a short live verification call is used to match you against your records. Only after these checks does the team initiate a controlled reset of access.

There are limits to what recovery can do, and they are deliberate. We cannot restore access to a third party who merely knows your email address, and we cannot reverse transactions that left the platform before a freeze was requested. This strictness occasionally costs time for legitimate owners, and we accept that trade-off because it protects every other account on the platform.

7. API key permissions

Connections to exchanges run through API keys with defined scopes, and the platform uses read and trade permissions for the connections it needs. Withdrawal permission is a separate scope that stays under your control, and our standard setup instructions require it to be disabled on any key connected to the platform. This separation means a compromised trading key cannot move funds off an exchange by itself.

You can review the keys on your account at any time, see when each was created and last used, and rotate or revoke them yourself. Rotating a key takes effect immediately for new activity, and your manager can help schedule rotation to avoid interrupting running strategies.

8. Audit history

Sign-ins, API connections, strategy changes and settings modifications on your account are recorded with timestamps and remain reviewable in your history. The record exists for disputes as much as for security: if you ever question when a setting was changed or who changed it, the audit trail answers with data rather than memory.

The same discipline applies on our side. Access by staff to client records is logged and reviewed, and incident responders operate under the same audited permissions. An audit log nobody reviews is just a large file, so review is part of the weekly routine in the Port of Spain office.

9. Incident support

If you suspect a security problem with your account, contact support at [email protected] and request account freeze handling. Freezing pauses withdrawals and API activity pending review, and a case is escalated to the security lead rather than waiting in a general queue. You will receive acknowledgment during working hours, Monday to Friday, 8:00–17:00 (AST), and a named handler for the case.

During an incident, expect communication in a set order: confirmation of the freeze, findings of the review, and the actions taken, including anything you should change such as passwords or paired devices. If an incident originates on our side, affected clients are notified directly with what happened, what data was involved, if any, and what we did about it.