Security of your InfinitAI account
Security on InfinitAI is not a single feature but a set of habits, controls and checks that work together from the moment your account is created. This page explains each measure in plain language: what it protects, how to switch it on and what to do if something looks wrong. Read it once from start to finish; it takes five minutes and is the best investment you can make in your own account safety.
1. Two-factor authentication
Two-factor authentication (2FA) adds a second proof at login: something you know, your password, plus something you hold, a one-time code from an authenticator app on your phone. InfinitAI supports time-based one-time password (TOTP) apps such as Google Authenticator, Microsoft Authenticator and Authy, as well as codes delivered to your verified email address.
Turning 2FA on takes under two minutes from the account settings screen, and we strongly recommend enabling it before your first deposit. If you lose access to your device, recovery follows the process in point 6; a reset is never granted on the basis of a phone call alone.
2. Encryption of data
Data is encrypted both while it travels and while it rests. In transit, all connections between your browser or the mobile dashboard and the platform use TLS, so passwords, personal details and account activity cannot be read by anyone intercepting the connection. At rest, personal records and documents you submit for verification are stored in encrypted form, and decryption keys are held separately from the data itself.
The scope covers account credentials, identity documents, payment instructions and the audit log. The systems responsible are the account service, the document vault used for verification uploads and the payments gateway. Access to decrypted data is limited to specific roles in support and compliance, every such access is logged, and keys are rotated on a fixed schedule.
3. Fraud and phishing protection
Phishing, fake messages that imitate a real company to steal logins, remains the most common way accounts are compromised, so we maintain an unambiguous rule: our official domain is infinitai-app.com and every email we send comes from an @infinitai-app.com address. We never ask for your password, your 2FA codes or remote access to your device, and we never ask you to move funds to a "safe account". Anyone who does is impersonating us.
Every official notification carries a short protective code that you set when activating your account, so you can confirm a message is genuinely ours. If a message, call or website looks like InfinitAI but feels wrong, do not click, do not share anything, and forward it to [email protected]. Our Fraud warning page lists known clone patterns.
4. Login notifications
You receive an email alert whenever a new device or browser signs in to your account for the first time, and push notifications through the dashboard where you have enabled them. Alerts include the device type, the approximate location derived from the network and the time of the sign-in in IST. A sign-in from an unfamiliar city at an unusual hour is often the first visible sign of a stolen password.
Suspicious activity, such as repeated failed logins, a password change you did not make or an attempt to add a new withdrawal destination, triggers an immediate notification and can place a temporary safety hold on withdrawals until you confirm the change. If you ever receive such an alert and do not recognise the activity, follow the link in the alert to lock the account and contact support the same hour.
5. Device and session management
The security screen lists every active session: which devices are signed in, from where and when they were last used. You can end any session with one button, which signs that device out immediately, useful if you left your account open on an office machine or a phone you no longer own. Signing out on all devices at once is available when you change your password.
Sessions expire automatically after a period of inactivity, and a longer automatic timeout applies to sessions that only viewed the dashboard without any interaction. Password changes and 2FA resets end all other sessions by default. Together these rules mean an abandoned login does not stay alive indefinitely.
6. Account recovery
If you lose your password, recovery starts from the login screen using your registered email, and the reset link can only set a new password, never reveal the old one. If you lose the device that holds your 2FA codes, recovery requires identity verification: you will be asked to confirm personal details and, where necessary, to submit a fresh identity document for comparison with the one used at onboarding.
Recovery requests are handled by the support team during working hours and are subject to a cooling-off review before 2FA is reset, precisely because this is the step an attacker would most like to abuse. Expect to answer questions about recent account activity. These checks exist to keep your funds reachable by you and no one else.
7. API key rights
Where the platform connects to an exchange on your behalf, the connection uses keys with the narrowest rights that still allow the job. Three levels exist: read-only keys that can view balances and history, trade keys that can also place and close orders, and withdrawal keys that can move funds out. By default InfinitAI requests read and trade rights only; withdrawal rights are deliberately not requested, and you should be suspicious of any service that insists on them.
Keys are stored encrypted, are never displayed in full after creation and can be revoked from your dashboard at any time. Revoking a key takes effect within moments on the exchange side. If you ever suspect a key has leaked, revoke it first and tell us second; the order matters.
8. Audit history
Every security-relevant event on your account is written to an audit log you can see: sign-ins, password and 2FA changes, new devices, connections and disconnections of exchange keys, changes to strategies and settings, and every withdrawal request with its destination. Entries carry a timestamp in IST and cannot be edited or deleted from your side.
The same log is mirrored on our infrastructure for incident investigation. When you contact support about anything unusual, the team reads this history first, which is why precise dates from you speed up every investigation. We recommend glancing through your own audit screen weekly; it takes a minute and makes silent tampering practically impossible.
9. Support during incidents
If you suspect your account is compromised, write to [email protected] with the subject line "Security" and state the last activity you recognise. Support can place an immediate protective block on the account, freezing withdrawals and strategy changes while the audit log is reviewed. Blocking is fast and reversible; do not hesitate to request it on suspicion alone.
Escalation follows the severity: routine questions are answered within one business hour during Monday to Friday, 9:00–18:00 IST (excluding public holidays), while active incident reports are escalated to the security team the same working day. You will receive an acknowledgement with a reference number, a named handler and the expected next update time, so you are never left wondering whether the report vanished into a queue.
Security is a shared effort
Platform controls stop most attacks, but three habits on your side close the remaining gap. Use a unique password for this account, one you do not use anywhere else. Keep 2FA enabled at all times, including quiet periods when you are not trading. Treat any unexpected contact that mentions your money, however convincing, as guilty until proven otherwise by writing to the address above. Security questions can also be raised through your personal manager, who loops in the support team on your behalf.