Security at Lendarance

You can protect your account with a time-based code from an authenticator app, or a one-time code sent by SMS where an app is not available. We strongly recommend the app because phone numbers can be hijacked through SIM-swap fraud.

2FA is required before your first withdrawal and optional for browsing the dashboard. If you lose your device, recovery runs through identity checks with support, using the backup codes you saved when you switched 2FA on.

Practical tip: save your backup codes in a password manager or print them and keep them somewhere safe at home. Do not store them in an email inbox that an attacker could reach, and do not take a screenshot that syncs to a cloud photo library.

Data travels between your browser and our servers over TLS, so anyone watching the network sees only scrambled traffic. Personal data and credentials at rest are encrypted in the databases that hold them, and passwords are stored only as salted hashes, never in readable form.

Encryption covers the website, the account dashboard and the services that store API connection details. The engineering and security teams are responsible for these systems and review them on a regular schedule.

Encryption protects data in transit and at rest, but it cannot protect a device that already has malware on it. Keep your phone and computer updated, install updates promptly and avoid signing in on shared or public computers, where keystrokes can be recorded.

Our only website is lendarance.org and our emails come only from [email protected]. Any other domain claiming to be us should be treated as fake. You can also set an anti-phishing code in your account settings. Real emails from us then include that code.

We will never ask for your password, your 2FA code or your API secret by email, phone or chat. If a message seems urgent and asks for those, it is a scam. Forward it to us and delete it. See the Fraud warning.

If you are ever unsure whether a message is real, do not click the link in it. Open a new browser tab, type the address yourself and sign in from there. If there is a genuine notice, you will see it in your dashboard as well.

When a sign-in comes from a new device or an unusual place, we email you, and send a push notification if you use the mobile app. The message shows the approximate location, device type and time so you can judge quickly whether it was you.

If it was not, use the link in the message to lock the account and reset your password. Suspicious activity, such as many failed attempts in a row, also triggers an alert and a temporary block.

Treat each alert as useful information, even when it turns out to be you on a new phone. A habit of checking alerts straight away is one of the cheapest and most effective defences you have against account takeover.

Your dashboard lists every active session with its device, browser and last activity. You can end any session at any time, which signs that device out immediately and revokes its access.

Sessions also expire by themselves after a period of inactivity, so a laptop left open at a café does not stay signed in indefinitely. Signing in again takes only your password and, if enabled, your 2FA code.

Make a habit of reviewing the session list after travelling or after using a borrowed device. Ending sessions you do not recognise costs nothing and takes seconds, and it is a good first step if you suspect your password has been exposed.

If you cannot sign in, start recovery from the sign-in page. We verify your identity by email and, where needed, ask support to compare a photo ID with the details on file. We do this slowly on purpose because a quick recovery process is what an attacker would want.

Recovery has limits. After a reset, withdrawals may be paused for a short period and new payment details may need confirmation, so a thief with partial access cannot empty the account.

Keep the email address on your account under your own control, with its own strong password and two-factor sign-in. Recovery usually runs through that inbox, so whoever controls it is one step away from controlling your recovery process.

To link an exchange, you create an API key at that exchange. Give it only the permissions it needs: reading balances and placing trades. Never enable withdrawal permission on a key you connect to Lendarance; we do not need it and will not ask for it.

You can restrict the key to our server addresses if the exchange allows that, and you can delete it at the exchange at any moment to cut the connection. Your account manager can check the permissions with you during setup.

Review your exchange API settings every few months. Exchanges sometimes change default permissions, and old keys from tools you no longer use should be deleted rather than left active. A key that no longer exists cannot be stolen.

Your account keeps a log of sign-ins, exchange connections, changes to strategies and changes to security settings, each with a date and time. You can open it from the dashboard whenever you like.

Review it now and then. An entry you do not recognise, such as a new connection or a changed setting, is an early sign that someone else has access. Tell us at once if you see one.

We keep this history for the period required by Australian law so that it is available if you or a regulator need to reconstruct events. It is part of how we investigate complaints and unusual activity on an account.

If you suspect something is wrong, email [email protected] or call your account manager, who is reachable around the clock. We can lock the account within minutes, pause automated activity and begin a review.

We escalate serious cases to our security team, explain what we found and what happens next, and keep you updated until it is resolved. Where the law requires it, we notify the regulator and affected users.

Our support team will never ask you to move money to a “safe account”. If anyone claiming to be us asks you to, stop, end the call and contact us at the email shown on this page.