Security & trust
Trading technology demands more than marketing claims. This is how LeverageFx and AEGIS approach protection of accounts, keys, and operational integrity.
Authentication
Email/password accounts, email verification, password reset, session tokens, logout-all devices, optional TOTP 2FA for portal access.
API key lifecycle
Keys are hashed at rest. Issue, revoke, rotate, and force-rotate paths support operational control. Mobile clients use account-scoped keys—not shared master secrets.
Credential protection
Broker credentials stored encrypted with a master key held in the server environment—not in the mobile app.
Device binding
Subscriptions enforce max devices. Lost phone: revoke binding without rotating every user on the platform.
Rate limiting & isolation
API rate limits and account-scoped data access reduce abuse and cross-tenant leakage.
Audit logging
Security-relevant actions (key issue/revoke, subscription changes, access events) are recorded for review.
Payments
Card/mobile money handled by payment providers (e.g. Paystack, Flutterwave, Stripe). Webhooks verify authenticity before activating entitlements.
Infrastructure
TLS in transit, environment-separated secrets, database and Redis isolation on the deployment host.
Data retention
Operational logs and diagnostics retained under policy; support reports omit raw API keys.
Responsible disclosure
Report suspected vulnerabilities to security@leveragefx.co. We prioritise fixes that protect customer funds and credentials.
See also the Security Statement and platform status.