Security Practices

Credentials

Passwords are stored hashed, never in readable form. Nobody at Gemini Trade can see your password, and support will never ask you for it.

Sessions are held as bearer tokens with a limited lifetime rather than as long-lived cookies. Signing out revokes the token immediately.

Two-factor authentication

Two-factor authentication uses standard time-based one-time codes and works with any authenticator app. Turn it on the day you join rather than the day you withdraw.

It is required for every withdrawal. This is deliberate: an attacker who obtains your password still cannot move money without your device.

If you lose the device, contact support from the account's email address. Restoring access requires verification, which takes time — a second enrolled device saves that trouble.

Devices and sessions

Every signed-in device is listed in Settings with the time it was last seen. Anything you do not recognise can be signed out from there, which invalidates its token at once.

Check this list if you have ever signed in on a shared or public machine.

The platform itself

The site makes no third-party requests on load: no external analytics, no advertising pixels, no embedded widgets, and fonts served from our own domain. Nothing about your visit is broadcast to anyone else's infrastructure.

Traffic runs over TLS end to end, and API access is authenticated per request rather than per browser session.

Administrative access to production is restricted and logged.

Reporting a problem

If you believe an account has been accessed by someone else, write to support immediately with the account email. Change your password first if you still have access.

Genuine reports of a security flaw are welcome and will be treated as reports, not as attacks. Exploiting a defect rather than reporting it is a different matter and ends the account.