How Visaya Capital protects your account

Your account supports two-step verification using a one-time code sent to your registered email or generated by an authenticator app on your phone. We recommend enabling it the day your account is activated, because it protects you even if someone learns your password.

Two-step verification is not legally mandatory for every account, but accounts holding active balances or making frequent withdrawals may be required to enable it before transacting. If you lose access to your second factor, recovery is handled through verified support contact: you will be asked to confirm your identity details on file before the factor is reset, and the reset itself is logged and reviewed.

Data is encrypted in transit using TLS on every connection between your browser and our systems, and sensitive fields are encrypted at rest in the storage systems that hold them. The scope covers account details, identity documents submitted for verification, and transaction records.

Encryption is applied and maintained by the platform engineering team, with responsibilities documented per system. Session tokens are scoped and expire automatically, and decryption of sensitive records requires authenticated access through the platform rather than direct database reads.

For you, this means two practical things. First, always check that the address bar shows our official domain before you enter credentials. Second, never send sensitive documents as plain email attachments when the dashboard upload form is available, because the upload path is the encrypted one.

Our official domain is visaya-capital.org, and every official message we send comes from that domain or from [email protected]. We never ask for your password, your full card number, or one-time codes over the phone, chat, or email.

Each account can set a support protective code, a short word known only to you and our team, so you can verify that a caller genuinely represents Visaya Capital. If a message or site looks like ours but feels off, do not enter your details: check the address bar, then report the approach to us immediately. See the Fraud warning page for the full checklist.

You receive an email notification when a new device signs in to your account for the first time, and alerts when activity patterns look unusual for you, such as a sign-in from an unfamiliar location or a password change you did not initiate.

Notifications go to your registered email address, so keeping that address current is part of keeping your account safe. If you receive a login alert you do not recognize, change your password immediately and contact support so the session can be terminated and reviewed. Alerts can be adjusted in the settings, but we recommend leaving new-device notifications on permanently; they generate at most a few emails a year for a typical user.

The security section of your dashboard lists every active session: the device type, approximate location, and when it last connected. From that list you can revoke any session instantly, which signs that device out and requires a fresh login.

Sessions end automatically after a period of inactivity, so a forgotten open tab on a shared computer does not stay live forever. If you lose a phone or laptop, revoke its session from another device and enable two-step verification before the replacement arrives.

Recovering access always starts with verifying that you are the account owner. Support will check your registered details against what is on file and, where needed, ask for a repeat of your identity verification before restoring access. This is deliberate friction: it is what stops an impostor from talking their way into your account.

Until verification is complete, recovery actions are limited: we can freeze the account to protect funds, but we will not change the email, reset factors, or process withdrawals. Expect recovery of a fully verified account to be completed within one business day of receiving your complete information.

Where the platform connects to an exchange account on your behalf, the API key you create for us can be scoped to exactly what is needed. The three standard scopes are: read (view balances and market data), trade (open and close positions), and withdraw (move funds out).

We ask only for the scopes your chosen strategies require, and we recommend withholding the withdrawal scope where a strategy does not strictly need it. You can revoke or rotate a key at any time from your exchange account, and revoked keys stop working immediately. Rotating a key is also the correct response any time an exchange reports an unfamiliar access pattern on your account.

Significant events on your account are recorded: logins and their devices, exchange connections, strategy changes, and updates to security settings. The history is visible to you in the dashboard, so you can check what happened and when without asking anyone.

The same records support our internal reviews and any investigation you request through the complaints process. If you ever dispute a change you did not make, the audit history is the first place we look together. Entries cannot be edited or removed by anyone, including our own staff, which is what makes the record trustworthy in the first place.

If you suspect unauthorized access, the fastest route is email to [email protected] with the subject line "Security". We can freeze the account while the situation is reviewed, which stops logins and withdrawal requests without touching your funds.

An incident follows a documented order of communication: acknowledgment first, then what we know, then what we are doing, then the outcome. Security events are escalated to the responsible team on the same business day, and you are told the outcome of the review in writing.