Account Security

Protect your TradeStaq account with robust security measures.

Overview

Your TradeStaq account has access to your exchange API keys and trading bots. Keeping it secure is critical. This guide covers:

• Two-factor authentication (2FA)
• Password management
• API key security
• Session management
• Security best practices

Two-Factor Authentication (2FA)

Why Use 2FA?

Even if someone obtains your password, 2FA prevents unauthorized access by requiring a second verification step.

Supported 2FA Methods

Setting Up Authenticator App

1. Download an authenticator app:

   • Google Authenticator
   • Authy
   • Microsoft Authenticator
   • 1Password

2. Navigate to Settings → Security → Two-Factor Authentication

3. Click Enable 2FA

4. Scan the QR code with your authenticator app

5. Enter the 6-digit code from the app

6. Save your backup codes securely

Backup Codes

When enabling 2FA, you receive 10 backup codes:

XXXX-XXXX-XXXX
XXXX-XXXX-XXXX
XXXX-XXXX-XXXX
...

• Store these offline (printed or password manager)
• Each code can only be used once
• Regenerate if compromised

Disabling 2FA

1. Navigate to Settings → Security → Two-Factor Authentication
2. Click Disable 2FA
3. Enter your current 2FA code
4. Confirm with password

Note: Disabling 2FA reduces your account security. Only disable if absolutely necessary.

Password Management

Password Requirements

• Minimum 12 characters
• At least one uppercase letter
• At least one lowercase letter
• At least one number
• At least one special character

Changing Your Password

1. Navigate to Settings → Security → Password
2. Enter current password
3. Enter new password
4. Confirm new password
5. Click Update Password

Password Best Practices

1. Use a password manager - Generate and store unique passwords
2. Never reuse passwords - Each account should have a unique password
3. Avoid personal info - No birthdays, names, or common words
4. Update regularly - Change passwords every 6-12 months

API Key Security

Your exchange API keys are sensitive. If compromised, attackers could execute trades on your account.

Safe API Key Practices

On the Exchange Side

1. Enable IP whitelisting: Only allow TradeStaq's IPs
2. Minimal permissions: Only enable required permissions
3. Separate keys per service: Don't reuse keys across platforms
4. Set trading limits: Enable withdrawal whitelist on exchange

On TradeStaq Side

1. API keys are encrypted at rest (AES-256)
2. Keys are never displayed after initial entry
3. Keys are only decrypted when needed for trading

Required vs Optional Permissions

Note: Never enable withdrawal permissions on API keys used with TradeStaq or any third-party service.

Rotating API Keys

Periodically rotate your API keys:

1. Create new API key on exchange
2. Update key in TradeStaq (Settings → Exchanges → Edit)
3. Verify connection works
4. Delete old API key on exchange

Session Management

Active Sessions

View all logged-in devices:

┌─────────────────────────────────────────────────────┐
│  Active Sessions                                     │
│  ─────────────────────────────────────────────────  │
│  🖥️  Chrome on Windows                              │
│     IP: 192.168.1.100                               │
│     Last active: Just now (Current)                 │
│                                                     │
│  📱 Safari on iPhone                                │
│     IP: 10.0.0.50                                   │
│     Last active: 2 hours ago                        │
│     [Revoke]                                        │
│  ─────────────────────────────────────────────────  │
│  [Sign Out All Other Devices]                       │
└─────────────────────────────────────────────────────┘

Revoking Sessions

If you see unfamiliar sessions:

1. Click Revoke next to the session
2. Or click Sign Out All Other Devices
3. Immediately change your password
4. Enable 2FA if not already

Session Timeout

Sessions automatically expire after:

• 30 days of inactivity
• Password change
• Manual sign out

Security Alerts

Login Notifications

Receive alerts for:

• Successful login from new device/location
• Failed login attempts (3+)
• Password changes
• 2FA changes

Configuring Alerts

1. Navigate to Settings → Security → Alerts
2. Enable desired notifications
3. Choose delivery method (Email, Telegram)

Security Audit Log

View recent security-related activity:

Access via Settings → Security → Audit Log

Account Recovery

Lost 2FA Access

If you lose access to your authenticator:

1. Use a backup code to log in
2. Disable 2FA
3. Re-enable with new device

Lost Backup Codes Too

1. Contact hello@tradestaq.com
2. Provide:
   • Account email
   • ID verification
   • Recent transaction details
3. Recovery process takes 3-5 business days

Forgot Password

1. Click Forgot Password on login page
2. Enter email address
3. Check email for reset link
4. Create new password
5. Log in with 2FA (if enabled)

Security Checklist

Regular security maintenance:

• 2FA enabled with authenticator app
• Strong, unique password
• Backup codes stored securely offline
• Review active sessions monthly
• API keys have minimal permissions
• IP whitelisting enabled on exchanges
• Security alerts enabled
• No withdrawal permissions on API keys

Reporting Security Issues

If you discover a security vulnerability:

1. Do not publicly disclose
2. Email security@tradestaq.com
3. Include detailed description
4. We'll respond within 24 hours
5. Eligible for bug bounty program

Next Steps

• Notification Settings - Configure alerts
• Wallet Settings - Manage funds
• FAQ - Common questions