Security at AfriLegacy AI

Your account sits behind several layers of protection, and most of them are visible to you as the user. This page explains each layer in plain language: what we operate on our side, what you control on yours, and what to do the moment something feels wrong. Read it once before your first deposit and you will know exactly where every switch lives.

Security / 9 controls

Nine controls that protect your account

Two-factor and multi-factor authentication

Two-step verification is available to every user and we strongly recommend switching it on the day you register. The platform supports time-based one-time password (TOTP) apps such as Google Authenticator and Authy, as well as one-time codes sent to your registered email address. SMS delivery is offered only as a fallback where an authenticator app is not practical for you.

Use of 2FA is not compulsory at registration, but certain sensitive actions, first withdrawals and changes to your withdrawal details, require a second factor even if you have left it off for daily sign-in. If you lose access to your authenticator device, recovery is handled through the support team with identity verification, never through an emailed link alone.

Encryption of data at rest and in transit

Everything that moves between your browser and the platform travels over TLS 1.2 or higher, which is the same standard your bank uses for online banking. You should always see the padlock in your address bar on our domain before entering your password.

Data at rest, identity documents, transaction records and account details, is stored encrypted on systems operated under restricted administrative access. The encryption scope covers the account database, document storage and backups. Responsibility is split between our infrastructure team, which manages the keys and access control, and the compliance function, which audits who accessed what and when. No support agent can read your password; it is stored only as a salted hash.

Anti-fraud and phishing protection

Official communication from AfriLegacy AI comes only from the afrilegacy-ai.org domain and from the support address published on this site. Any message that claims to be us but arrives from a look-alike domain, a free mail service or a number you cannot verify is not us, even if it carries our logo. Our full guidance is on the Fraud Warning page.

Every official email we send about account actions includes a reference code tied to the event it describes. If a message asks you to move money, share a code or "verify" your password and you are unsure of it, stop and write to [email protected] first. We will never phone you to ask for your password, your one-time codes or remote access to your device, and we will never pressure you to deposit in order to "unlock" a withdrawal.

Login notifications

Each sign-in from a device your account has not seen before triggers an email notification to your registered address, showing the time, the approximate location derived from the IP address and the device type. You do not need to enable this; it is on by default because it costs you nothing and catches problems early.

Suspicious activity, a sign-in attempt from a new country, repeated wrong passwords or a password reset you did not request, generates an immediate alert and can freeze the session pending confirmation. If you receive a login alert that was not you, follow the rejection link in the email and change your password straight away.

Device and session management

The security section of your dashboard lists every active session: browser sessions on desktop, the mobile app and any API connections. Each entry shows the device, the last activity time and a button to end that session immediately. Ending a session does not change your password; it simply signs that device out.

Sessions that remain idle for an extended period are closed automatically, and signing out on a shared computer clears the session cookie completely. If you lose a phone or laptop, you can revoke its access from any other signed-in device within seconds, which is why we recommend keeping at least two trusted devices linked to your account.

Account recovery

Recovering an account always starts with proof that you are its owner. The support team will ask for your registered details and, where necessary, a short identity verification against the documents you supplied at KYC. Recovery by phone is possible for locked accounts, but withdrawal functions stay disabled for 24 hours after any recovery event as a cooling-off measure against takeover attempts.

There are limits to what recovery can do: we cannot restore an account to a different owner, and we cannot reverse transactions that were authorised with your password and second factor. That restriction protects you, because it means a fraudster who talks their way past a call centre agent still cannot walk away with your balance.

API key permissions

If you connect the platform to an exchange account, the connection runs through an API key whose permissions you can see and restrict. The platform requires only what the strategy needs: read access for balances and prices, and trade access where automated execution is enabled.

Withdrawal permission is never required by AfriLegacy AI. If any third party ever asks you to create an API key with withdrawal rights, treat it as a fraud signal. Keys you create can be revoked at any time from the dashboard, and revocation takes effect immediately.

Audit history

Your account keeps a complete audit log: every login, every new device, every change to your strategies, risk parameters or withdrawal details, with timestamps. The log cannot be edited or deleted by anyone, including our staff, which makes it the reference point whenever there is a dispute about what happened and when.

We encourage clients to glance at the audit history whenever they change settings, the same way you check a till slip. If an entry appears that you do not recognise, that is the moment to change your password and contact support, not after the next statement.

Support during incidents

If you suspect that your account has been accessed without your permission, write to [email protected] immediately with the word URGENT in the subject line, or ask your personal manager to escalate. As a first step you can freeze your own account from the dashboard, which blocks all trading and withdrawals while the review is under way.

Incident reports are triaged the same business day. The expected sequence of communication is: confirmation that the report was received, a summary of what the audit log shows, the corrective action we are taking, and a follow-up once the case is closed. Support hours are Monday to Friday, 08:00–18:00 SAST (excluding public holidays), but a freeze requested outside those hours still takes effect immediately.

Security is a shared effort: we run the infrastructure, the monitoring and the verification, while you keep your password unique, your second factor switched on and your scepticism healthy. The AML / KYC policy explains the identity checks that sit alongside these controls.