Security of your account and your data
Security on a financial platform is shared work: we provide the infrastructure and the controls; you provide the first barrier, which is your own access. This page explains the nine layers of Thriventage security and what you can do at each one to trade with peace of mind.
1. Two-step verification (2FA/MFA)
The platform supports two-step verification through an authenticator app (the kind that generates six-digit codes every thirty seconds) and by text message as an alternative. We recommend the app: SMS codes can be intercepted if your phone line suffers a fraudulent SIM swap.
Activation is optional at registration, but it becomes mandatory to enable withdrawals and to connect exchange API keys. If you lose your device, recovery is done by verifying your identity with the support team: nobody can skip that step, not even you — and that is how it should be.
2. Data encryption
All data travelling between your device and the platform is encrypted with TLS in transit, including forms, sessions and dashboard calls. Sensitive data at rest (identifications, financial data, access logs) is stored encrypted on segregated systems, with role-restricted, logged access.
The scope of encryption covers the user databases, the storage of verification documents and the audit logs. Responsibility sits with the internal infrastructure and security teams, with periodic access reviews and secure-deletion policies when data is no longer needed.
3. Fraud and phishing protection
The platform’s official domain is thriventage.org: type it directly into your browser and save it as a bookmark. We never send sign-in links and never ask for passwords, verification codes or card details by phone, chat or email. Any message that does is not from us.
As an extra layer, you can set up a verification word for support calls: when assisting you, the manager confirms it so you know you are speaking with Thriventage and not an impostor. Report any suspicious message to [email protected] and see the fraud warning.
4. Sign-in notifications
Every sign-in from a new device or location triggers an email notification with the access details: date, time, device type and approximate origin of the connection. If you recognise the access, do nothing; if you do not, the email itself contains the link to close that session and change your password.
Alerts about suspicious activity (repeated failed attempts, changes to contact details or withdrawal settings) follow the same mechanism. The idea is simple: no important action on your account should happen without you knowing within minutes.
5. Device and session management
Your dashboard shows the list of active sessions: desktop browser, mobile app, tablet. Each entry shows when it started and from where, and you can close it individually or close all except the current one with a single button. It is the recommended first action if you lose a device or notice anything odd.
Inactive sessions close automatically after a period without activity, and a full sign-out is mandatory after certain sensitive events, such as a password change or an update to withdrawal details, so that no old session keeps expired privileges.
6. Account recovery
If you lose access (forgotten password, stolen phone), recovery goes through identity verification with the support team: account details, proof of identity and, depending on the case, a brief video call. The process is deliberately strict because it is also the barrier that stops whoever is trying to steal someone else’s account.
Deliberate limitations: contact emails and withdrawal details cannot be changed in a single interaction, and accounts with two-step verification are not recovered on email alone. Everything is documented for your protection and ours. Write to [email protected] to start the process.
7. API-key permissions
When you connect an exchange using API keys, each key can carry three permission levels: read (view balances and movements), trade (execute orders) and withdraw (move funds out). The platform’s default setup requests only read and trade: the withdrawal permission is not needed for the strategies to work.
You can view and revoke active keys from your dashboard at any time. Direct recommendation: if a feature does not require a permission, do not grant it. Smaller attack surface, less possible damage in any incident.
8. Audit history
The platform logs with a date and time: sign-ins, exchange connections and disconnections, changes to strategies and their parameters, modifications to contact details and withdrawal requests. That history is available in your dashboard and constitutes the version of facts that both parties can consult in any doubt or discrepancy.
The records are read-only: neither you nor any employee can edit them. If at any point you need an extract for a clarification or a complaints procedure, request it and we will provide it complete, in writing.
9. Support for security incidents
If you suspect unauthorised access, act in this order: close all sessions from the dashboard (or with support’s help if you cannot get in), change your password from a trusted device and write immediately to [email protected] with the subject line “Security incident”. The team can freeze the account preventively while the case is investigated.
Escalation follows a clear order: support opens the case with a reference number, passes it to the security team for analysis and, if funds are at risk, coordinated actions follow with the exchanges and processors involved. We keep you informed at every step, with defined communication times: immediate acknowledgement and a first update within the next business day.
What you can do today
Five fifteen-minute actions that close the doors attackers use most. Turn on two-step verification with an authenticator app instead of SMS. Change your password to a long, unique passphrase stored in a password manager. Review the dashboard’s list of active sessions and close any you do not recognise. Confirm that your recovery email is one you actually check, because that is where access alerts arrive. And bookmark the site’s official address so you never enter from links received in messages.
After that, repeat the session review once a month and read the access alerts when they arrive: they are three seconds that catch a problem before it grows. None of these measures costs money, and together they close the vast majority of the real routes attackers use against accounts on financial platforms.
Technical security does not remove market risk: your investments can lose value even with your account perfectly protected. Also read the risk disclosure and the identity-verification policy.