Security
Security on Steadfast Cargence is layered: something you know (your password), something you have (your device and one-time codes), and a set of monitoring systems that watch for behaviour that should not be happening. This page explains all nine layers, how recovery works when something goes wrong, and how to reach us fast when it matters.
1. Two-factor authentication
Two-factor authentication (2FA) adds a second proof at sign-in: a six-digit time-based code from an authenticator app on your phone, or a hardware key where supported. 2FA is mandatory for every account: a stolen password alone gets nobody into your account, because the code changes every thirty seconds and never leaves your device. We support any TOTP authenticator app, and recovery codes are issued when 2FA is enabled so a lost phone does not lock you out. If you lose both the device and the recovery codes, restoration follows the identity-verification path described in section 6 of this page.
2. Encryption
All traffic between your browser and our systems is encrypted in transit with current TLS; if a connection cannot be negotiated securely, it is refused. Personal information, identity documents, and account records are encrypted at rest in storage. Encryption applies across the systems that matter: the account database, document storage used for verification, backups, and the internal tooling staff use. Encryption keys are managed separately from the data they protect, rotated on a schedule, and never exposed in application code or logs. Backups are encrypted with the same discipline, so an old copy of a database is not a weak copy. Encryption is also scoped by need: the systems that render web pages do not hold the keys that unlock document storage, which means a fault in one compartment cannot quietly expose another.
3. Anti-fraud and phishing protection
The only official domain for this service is steadfast-cargence.org: sign in only via your bookmark or by typing it. Messages from us are sent from that domain and never ask for your password, your one-time code, or remote access to your device. Where a message concerns a money movement, the platform also shows the same event inside your account, so you can verify it in a second channel. Our fraud team monitors for clone sites and impersonation accounts and publishes current findings on the Fraud Warning page. If a message or site looks like us but feels off, stop, do not enter anything, and forward it to [email protected].
4. Login notifications
You receive an email alert whenever a new device or browser signs in to your account, whenever a login fails repeatedly, and whenever activity appears that our systems flag as unusual for you, such as a password change, a change to your withdrawal details, or a connection from a new country. Alerts are sent to the address on file even when you have unsubscribed from marketing. If you receive an alert about something you did, tell us immediately: it means someone has your credentials, and we will revoke sessions and force a credential reset on the spot. Alerts are deliberately plain: device type, approximate place, time, and a one-click path to the session list. We do not use alerts as marketing, so when one arrives, it deserves a look. A user who reads every alert turns account takeover attempts into non-events.
5. Device and session management
The security page in your account lists every active session: device type, approximate location, and time of last activity. You can end any session remotely, which is useful when a phone is lost or a shared computer was used by mistake. Sessions expire automatically after a period of inactivity, and sign-ins require fresh two-factor proof after sensitive actions. If you retire a device, sign out on it or end its session from the list; the device list is also visible to support when you ask us to check. Sessions on shared or public computers expire faster, and sensitive screens, such as withdrawal destinations, always require fresh authentication regardless of an active session. Remote session control plus login history means a stolen phone is an inconvenience rather than an emergency.
6. Account recovery
Recovering access always requires proof that you are the account holder: identity verification against the documents we already hold, answers to security checks on the account's history, and, for anything touching money, a live conversation with a manager who verifies you directly. Password resets go only to the verified email address on file. Recovery is deliberately slower than logging in; that friction is the protection. We will never recover an account based on a message that arrives out of nowhere, however convincing, and we will never use a phone number that was added minutes earlier. Recovery attempts are themselves logged and reviewed: a cluster of failed recoveries on one account is treated as an attack on it, triggering protective freezes before anyone has to ask. The slower path is the safer path.
7. Connection and key permissions
Where the platform connects to a trading venue for your account, the connection keys follow least privilege: read access for balances and prices, and trade access only where a strategy requires it. Withdrawal permission is never required by the engine, is never requested at registration, and, if a key with withdrawal rights appears on an account, it is flagged for review. You can see which connections are active on your account and what each one is allowed to do, and you can revoke any of them at any time; revocation takes effect immediately.
8. Audit history
Security-relevant events are logged and retained: sign-ins with device and network context, failed login attempts, password and 2FA changes, connection key changes, strategy starts and stops, setting changes, and withdrawal requests. Logs are tamper-evident, access to them is itself logged, and reviews run both automatically, for anomalies, and manually, when a user raises a concern. The audit trail is what allows us to answer precisely what happened and when, and it is available to you for events on your own account on request. It is also the backbone of dispute resolution: when a complaint concerns what the platform did, the log is the evidence, and both sides of the conversation look at the same records. Logs are retained under the schedule in our Privacy Policy and purged when their window closes.
9. Help during a security incident
If you suspect unauthorised access, a phishing attempt, or a compromised device, contact [email protected] immediately, marking the message urgent. First actions are on our side: freeze the account against withdrawals, revoke active sessions, and preserve the audit trail. A named handler then owns the incident through investigation, findings, and remediation, and communicates at each step: what we know, what we have done, and what happens next. Support hours are Monday to Friday, 8:30 to 17:30 AEST, but security reports are actioned as soon as seen, and users are never charged for our response to a security incident.
Security is a partnership. Our side is described above; yours is a unique password, 2FA on, a bookmarked address, and a fast report when something looks wrong. The AML and KYC page explains the verification side, and the Risk Disclosure covers what security cannot protect: market risk.