How your account is protected
Security at Bryzenta is a set of working systems, not a badge on a page. This page describes each one plainly: what it does, whether it is compulsory, and what to do the moment something looks wrong.
1. Two-step verification (2FA / MFA)
Your account supports a second authentication factor from an authenticator app (time-based one-time codes) or by SMS code to your verified phone number. Two-step verification is strongly recommended and we prompt for it during onboarding; once enabled, a password alone is not enough to sign in, which defeats the most common kind of account takeover. Recovery is deliberately strict: if you lose your device, identity is verified with our support team through documented checks before the factor is reset, and we never send reset links to an email address that has itself just changed. If you use an authenticator app, keep your recovery codes somewhere safe offline; they are the fastest route back into your own account, and the only one that does not involve a support call.
2. Encryption
All traffic between your browser and the platform travels over TLS, and personal data held by the platform is encrypted at rest. Encryption covers the systems that store your registration details, identity documents and communication history. Responsibility for the key management and storage systems sits with our infrastructure and security teams, whose access is itself logged and reviewed, so the protection extends inward as well as outward. Documents you upload for verification are kept in a restricted store whose access is limited to the compliance reviewers who need them, and each access is written to the audit log described in section 8 below.
The two sections above are the foundation; the seven that follow are the parts of the security system you can see and touch as a user.
3. Fraud and phishing protection
Bryzenta operates a single official domain, and every message we send you comes from it or from an @bryzenta.org address. We never ask for your password, your one-time codes or your full card details by email or phone. When we need to confirm something sensitive, you will see it in your secure dashboard as well. If a message, call or website claiming to be Bryzenta breaks any of these rules, do not share anything and forward it to [email protected] immediately; the Fraud warning page lists what we already know about. A useful habit: before entering your password anywhere, check the address bar and read the domain out loud; clones rely on domains that look almost right at a glance, and almost right is exactly how they work.
4. Login notifications
You are notified by email whenever a new device signs in to your account, whenever a login comes from an unusual location, and whenever settings such as your withdrawal details or contact information change. These alerts are sent automatically and cannot be switched off by anyone but you, which means that an intruder cannot silently take over an account without leaving a trace you will see. If an alert names something you did not do, treat it as urgent and write to support at once. Each alert names the device, the approximate location and the time, so you can tell a genuine warning from a false alarm at a glance rather than guessing.
5. Device and session management
The security page of your dashboard lists every active session: the device type, the approximate location and the time of the last activity. You can revoke any session in one click, which signs that device out immediately, and idle sessions end automatically after a defined period of inactivity. Signing out on a shared or public computer should still be your habit, but if you forget, session management gives you the undo button. Changing your password also ends every other session, which is why it is the first step in the incident procedure at the end of this page.
6. Account recovery
Recovering access to a locked account requires verification of your identity with our support team, using the documents and checks from the onboarding process. Recovery is handled by people, not an automated reset link, precisely because an automated link is what an attacker would try to trigger. There are limits to what we can do: if the registered email and phone are both outside your control, recovery will take longer and involve additional checks, and that deliberate friction exists to protect you. A genuine recovery never requires you to pay anything, to move funds to a "safe account", or to install remote-access software; anyone asking for those things is not from Bryzenta, whatever they claim.
7. API key permissions
API keys used by the platform's automated activity are scoped to exactly the permissions needed: reading account data, executing trades, or initiating withdrawals. A key that only reads data cannot move money; a key that trades cannot change where withdrawals are sent. Permission levels are visible whenever a connection is created or reviewed, and we recommend the narrowest scope that supports the strategy in question. Never paste an API key anywhere outside the platform, including to someone claiming to be from support, and review the list of active connections with your manager whenever anything about your setup changes.
8. Audit history
Significant events on your account are recorded in an audit log you can see for yourself: logins and the devices behind them, API connections and their scopes, changes to strategies and settings, and withdrawal requests with their destinations. The log exists both for transparency and for investigation: if anything on your account ever behaves in a way you do not recognise, the history shows exactly what happened and when, and support works from the same record.
9. Support during an incident
If you suspect that your account has been accessed without your permission, act in this order. First, change your password from a device you trust. Second, revoke any session you do not recognise from the dashboard. Third, write to [email protected] with the word URGENT in the subject line; the Client Support & Compliance team can freeze withdrawals on an account while the situation is reviewed. You will receive an acknowledgement during Monday to Friday, 9:00–17:30 GMT/BST (excluding public holidays), normally usually under one business hour, and a named person will stay with the case until it is closed. Where an incident affects many clients, we publish what happened and what to do on this page.
A note on expectations, stated honestly: no platform, ours included, can promise that an incident will never happen. What we can promise is layered protection that makes incidents rare, detection that makes them short, and a named person who tells you plainly what occurred and what was done about it. Security questions of any kind, including ones this page has not answered, go to the same address and receive a real answer rather than a template acknowledgement.