1
Two-factor and multi-factor authentication
Every account can enable two-factor authentication (2FA) from the security settings, using a time-based one-time password app such as Google Authenticator or Authy. Multi-factor prompts also appear for sensitive actions: changing your withdrawal details, resetting your password or connecting a new exchange.
2FA is optional to browse but strongly recommended, and it becomes mandatory for accounts with elevated withdrawal volumes. If you lose your device, recovery is a verified process: you confirm your identity with our support team, a cooldown period applies, and a new factor is enrolled only after the check completes. Nobody at Bright Portmantage will ever ask you to read a one-time code aloud or forward it.
2
Encryption in transit and at rest
All traffic between your browser and the platform travels over TLS 1.2 or higher, and HSTS tells your browser to refuse anything less. Certificates are rotated on schedule and monitored for anomalies.
Personal data stored on our systems, including verification documents, is encrypted at rest on segregated storage. The scope covers the account database, document storage and backups. Access to these systems is limited to the infrastructure and compliance roles that require it, and every access is logged.
3
Anti-fraud and phishing protection
The only domain we operate from is bright-portmantage.com. Any other site, app store listing or social profile using our name is not ours, and we publish a fraud warning page listing what we know about clone operations.
Official messages from us carry a personal security code you set during onboarding, so you can confirm an email is genuinely from the platform. We never request passwords, one-time codes or remote desktop access, and we never ask for deposits to a personal bank account. If a message asks for any of these, it is not from us: report it and delete it.
4
Login notifications
Each login from a new device triggers an email alert with the time, approximate location and device type. A second notice goes out when we detect activity that does not match your habits: a login from a new country, several failed password attempts, or a withdrawal request that breaks your usual pattern.
These alerts are read-only notifications. If you do not recognize the activity, the fastest response is to open your account, end the session in question from the device list, change your password and contact support.
5
Device and session management
The security settings page lists every active session: browser sessions, the mobile app and any API connections. You can revoke any of them in one click, which signs that device out immediately and invalidates its tokens.
Idle sessions end automatically after a period of inactivity, and sessions expire fully on password change. For shared or public computers, always sign out manually; the session list lets you verify that you did.
6
Account recovery
Recovering access to a locked account always starts with identity verification: the documents from onboarding, plus checks against information only the real account holder would know. Recovery is handled by the support team, never by an automated chat, and a mandatory waiting period protects you while checks complete.
This is deliberately slower than a password reset link. The inconvenience is the point: a day of patience is a fair trade for knowing nobody else can talk their way into your account.
7
API key permissions
When the platform connects to an exchange on your behalf, it uses API keys with the narrowest permissions possible: reading market data and, where a strategy requires it, placing trades. Withdrawal permission is never enabled on keys used by the analysis engine.
Keys are stored encrypted, rotated on a schedule and revoked the moment a connection is removed from your account. You can review which exchanges are connected and what each key may do from the connections page at any time.
8
Audit history
Every security-relevant event is recorded: logins and failed logins, device additions, exchange connections and removals, strategy changes, parameter edits and withdrawal requests. The history is visible to you in the account activity log, not just to our engineers.
Records are retained per our data policy and are available to you as evidence if you ever need to dispute an event. If a line in the log is not yours, that is the moment to freeze activity and call support.
9
Incident support
If you suspect unauthorized access, write to [email protected] with the subject "Security" or call the support line. The first step we take together is locking the account: trading stops, withdrawals pause, and nothing changes until you and the team agree it is safe.
From there, the escalation order is: identity re-verification, a full audit of recent activity, credential and key rotation, and a written summary of what happened sent to your registered email. Expected response time is usually under 5 minutes on the support queue, and security subjects are prioritized ahead of it.
