1. Two-factor and multi-factor authentication

Naija AI supports time-based one-time codes from any authenticator app, including Google Authenticator, Authy and Microsoft Authenticator. Two-factor authentication is optional to browse the site but becomes mandatory the first time you enable withdrawals, and we recommend switching it on at registration, before any deposit. With 2FA active, a stolen password alone cannot open your account: the attacker also needs your physical device. To recover access after losing a device, use the backup codes shown exactly once when you enable the feature; if both the device and the codes are gone, identity verification through support is required, which brings a mandatory 24-hour hold on withdrawals as a protection against takeover attacks that mimic recovery.

2. Encryption of data

All traffic between your browser and the platform travels over TLS, and personal records are encrypted at rest in storage. Different classes of data sit in different systems with different access rules: identity documents in the verification store, payment details in the payments system, strategy settings in the trading engine. Access inside the company follows least privilege: a support officer can see your account status but not your password, which in any case is stored only as a salted hash and can never be read by anyone, including our engineers. The exchange API keys you add are stored encrypted and are never displayed in full after saving.

3. Fraud and phishing protection

Official communication comes only from the naija-ai.com domain, and every security-relevant email we send includes the first characters of your registered phone number as a protective code so you can verify the message is genuinely ours. We never ask for your password, a one-time code or remote access to your device. Websites at addresses other than naija-ai.com are clone operations however similar they look; the Fraud warning page lists the checks that separate us from copies. If a message claims urgency, quotes a profit you never made or pushes you to a different site, treat it as hostile and report it.

4. Login and activity notifications

By default you receive an email alert for every login from a new device, and additional alerts for password changes, email changes, new API keys and withdrawal requests. Each alert lists the device type, approximate location and time, so a login you do not recognise is visible within minutes rather than weeks. These notices are informational and arrive whether or not you have 2FA enabled; they are the tripwire that catches the rare attacker who already has your password. If an alert shows activity that is not yours, use the link in the email to freeze sensitive actions and contact support immediately.

5. Device and session management

The dashboard's security section lists every active session with device type and sign-in time, and each row has a revoke button that ends that session immediately. Changing your password revokes all other sessions automatically. Sessions expire after 30 days of inactivity, and idle sessions on shared computers time out after two hours. If you used a café system, a friend's laptop or a phone you no longer own, the session list is where you close that door after the fact; a revoked device must sign in again with full credentials, codes included.

6. Account recovery

Recovery exists to return your account to you and to keep it out of everyone else's hands, and both goals matter equally. Lost-password recovery goes to your registered email; lost 2FA recovery uses the backup codes; full identity loss, where both email and device are compromised, requires an identity check with support that can include a short live verification. All recovery paths apply a 24-hour withdrawal hold afterwards, because real recovery is rarely in a hurry while fake recovery always is. If someone contacts you offering to "speed up" recovery for a fee, that is itself the scam.

7. API key permissions

Exchange keys connected to the platform can carry three levels of permission: read, to view balances and history; trade, to open and close positions; and withdraw. The platform never requires withdrawal permission to operate, and we ask you never to grant it: strategies need read and trade, nothing more. When you create a key, restrict it to the IP addresses shown on the connection page, and delete any key you no longer recognise during your monthly review. Key creation and deletion are logged and notified like every other security event, so a key added without your action is visible the same hour.

8. Audit history

Every security-relevant event on your account is recorded with a timestamp: logins and failed login attempts, device additions, password and email changes, API keys created or removed, strategy and settings changes, and withdrawal requests with their outcomes. The history is visible to you in the dashboard and to support during investigations, and records cannot be edited or deleted by anyone, including staff. If you ever dispute what happened on your account, this log is the single source of truth both sides rely on, which is precisely why it is append-only.

9. Incident support

If something looks wrong, a strange login, a setting you did not change, a message you suspect is a fake, one email to [email protected] with "security" in the subject triggers the incident path: sensitive actions on your account, withdrawals above all, are paused while the team investigates. You receive a named contact, an acknowledgement within one working hour, and updates at least daily until resolution. Genuine incidents are escalated to the security lead and, where users' funds are implicated, to the relevant authorities. We would rather investigate a hundred false alarms than miss one real breach, so err on the side of writing in.

Your five-minute monthly check

Most account problems are visible weeks before they hurt, to anyone who looks. Once a month, the same day you check your bank statement, run through this list: the session list shows only devices you recognise; the audit history shows no logins you cannot explain; the API keys list contains only keys you created, with no withdrawal permission; your recovery email and phone are current; and the destination account for withdrawals is still yours. Five minutes, five checks, and the two most common takeover paths are closed. Users who make it a habit have never needed the incident path described above, which is exactly the point of habits.