How we protect your account and your data
Security at Pepperstone AI is a set of concrete, everyday measures: strong authentication, encryption everywhere your data travels, alerts when something unusual happens, and a clear path to a human when you need one. This page explains each measure and what it means for you in practice.
1. Two-factor authentication
Two-factor authentication (2FA) is available on every account and we recommend turning it on the day you register. It works with any time-based authenticator app, which keeps the second factor off your phone number and out of reach of SIM-swap attacks.
2FA is optional rather than forced, because some clients prefer fast access to their dashboard. If you lose your device, recovery is handled by our support team through identity verification, never through an automated link. Expect to answer questions about your account history and provide identity documents before 2FA is reset; that friction is deliberate.
2. Encryption
All traffic between your browser and the platform is encrypted with TLS, and the site always redirects to HTTPS. Personal data, identity documents and API keys are encrypted at rest in storage.
Encryption covers the systems that hold client records, account settings and verification data. Access keys are managed centrally, rotated on a schedule, and scoped so that a database administrator, for example, cannot read live authentication secrets.
3. Anti-fraud and phishing protection
Our official domain is the only address we ever send you to: type it yourself rather than following links in unexpected messages. Email from us is sent only from the Pepperstone AI domain, and we never ask for your password, a 2FA code, or remote control of your device.
If a message or call claiming to be from us pressures you to move money quickly, treat it as fraudulent and write to [email protected] straight away. The fraud warning page lists the signs we ask every client to know, including how we handle reports of cloned websites misusing our name.
4. Login notifications
You are notified by email when a new device signs in to your account for the first time, and when activity patterns look unusual, such as a login from a country you have never used the platform from.
Notifications are one-way information, not a confirmation step, so they never delay your access. If a notification shows a sign-in you do not recognise, change your password immediately, review the sessions list described below, and contact support so we can secure the account with you.
5. Device and session management
Account settings list every active session, with device type, approximate location and last activity. You can sign out any session individually or all of them at once, which is the right move after using a shared or public computer.
Sessions expire automatically after a period of inactivity, and changing your password invalidates existing sessions. If you hand an old phone or laptop on, removing its session takes one click and blocks further access without needing the device itself.
6. Account recovery
Password resets and 2FA recoveries both start with proving you are the account owner. Our team verifies identity against the documents you provided at registration and asks about recent account activity before making any change.
Recovery is only available through [email protected] or the contact page, never through a third-party channel. If someone offering "faster recovery" reaches out on chat apps or social media, that is not us; see the fraud warning page for how to report them.
7. API key permissions
Connecting an exchange account uses API keys you create yourself, with three possible permission levels: read-only, trading, and withdrawal. Our platform requests only what your chosen setup needs, and we ask clients to enable withdrawal permission nowhere, ever.
Keys are stored encrypted, and you can revoke any key from the exchange side at any time, which immediately stops any further automated action on that connection. If you are unsure which permissions a feature needs, your personal manager will walk you through it on a setup call rather than leaving you to guess. As a rule of thumb: an integration that only reads balances and prices can do its job with read-only permission, and anything that trades still does not need withdrawal rights.
8. Audit history
Your account keeps a chronological audit trail: sign-ins, password changes, new devices, strategy and settings changes, deposits, withdrawal requests and API connections, each with a timestamp.
The audit trail serves two purposes. Day to day, it lets you check that everything done on your account was done by you. If an issue is ever disputed, it gives both you and our team an objective record of what happened and when, which is also what the complaints process relies on.
9. Support during a security incident
If you suspect unauthorised access, act in this order: change your password, sign out all sessions from the settings page, then write to [email protected] with the subject line "Security". Our Client Support & Compliance team, available Monday to Friday, 9:00–17:30 AEST (excluding public holidays), responds to security reports as a priority, usually usually under one business hour.
On receiving a credible report we can temporarily freeze the account while identity is confirmed, suspend pending withdrawal requests, and review the audit trail with you. Where client data may have been exposed, we inform affected clients directly rather than leaving them to find out another way, and we cooperate with the relevant Australian authorities where required.
Incidents are reviewed after the fact, not just closed: every security event worth the name produces a short written review of what happened, what contained it, and what we changed so the same route is closed next time. Clients affected by an incident receive the outcome of that review on request, in the same plain English as this page.
One honest limit: no platform, ours included, can make you entirely safe from an attacker who has your password and your phone. The measures above work best combined with your own habits, a unique password, 2FA enabled, and healthy suspicion of unexpected messages. Those three habits cost nothing and stop most real-world attacks before any of our systems need to.