Articles on: Security

Security in Altrady

At Altrady, we take the security of your API keys and account details very seriously. The way you manage your account details is also an important part of keeping your account secure.

See also: How to Keep Your Altrady Account Safe

Log in details


Best practice is to use a strong, unique password for your Altrady account, and keep this in a secure place such as a password manager. Within your password manager, if there is an option to require the master password to be entered again for the site, then we recommend that you select that option.

In your password manager, select the option to require the master password to be re-entered when logging in

If you log in to your Altrady account from a shared computer, do not tick “Keep me logged in”.

If there is a sign-on to your account from a new location, Altrady will send a notification email to your account email address. So make sure Altrady's email address is whitelisted in your email manager. If you believe the log in is not you (keeping in mind that if you use a VPN, then the IP address and location might have changed), then we suggest that you reset your password immediately. This can done under Settings>Account Security.

FYI: You can also check whether your email address has been compromised by checking here. Enter your email address to find if it has been compromised on any websites where you have used it. If it has, then the password that you used on that compromised website will also have been revealed.
Note that Altrady has very tight security; passwords are encrypted; and no email addresses or passwords have ever been hacked.

2FA


Your next level of protection comes from adding Two Factor Authentication to your account. If you don’t already have 2FA enabled, you will be prompted to add it each time you log in. It can also be added under Settings>Account Security.
When 2FA is set up, you are also provided with a backup code. This code can be used to recreate the 2FA if you lose your phone. This code must be kept in a secure place such as a password manager.

If you lose your phone and don’t have a backup code, you can reach out to our Customer Support to reset the 2FA. However, it will always be necessary to complete an identity verification check to ensure that you are the genuine owner of the account before we can reset 2FA.

Five Word Passkey


The next level of protection is provided by the 5 word password. It is the encryption key for your API keys and is stored locally on your computer.
This password must be entered whenever:
On the browser: to add, edit or delete API keys
When a new device is used for the first time. A device includes: a new computer, browser, phone or tablet. Without the 5 word password, the device cannot be activated for trading.
So even if a hacker or thief has logged into your account, and used your phone to retrieve the 2FA, they will still not be able to trade on your account.

It is important to keep your 5 word password securely stored. If you don’t have a good password manager, then it should ideally not be on your computer.

API Keys


Altrady encrypts your API keys in the client and then stores your encrypted API keys on our server. They can only be decrypted using the five word password (as above). So Altrady's security keeps your keys safe from misuse. Note that, Altrady has no control over other places where your API key might be stored, such as on the exchange itself, or if you keep a record elsewhere of your keys and secrets. I these places, the Keys and Secrets might not be encrypted and can be vulnerable to hackers.


After generating API keys to use in Altrady, do not enter or record the Secret (Private Key) anywhere else.
Use a different API key for each purpose, and only grant the permissions that are necessary.

Bound API keys/IP whitelist

At the moment it is not possible to specify an IP whitelist on an exchange for your API keys. This is because it would need to list Altrady’s IP addresses. However, we have to use a rotating set of many IP addresses in order to avoid exchange rate limits (limits on how many API calls can be made in a short space of time).

If you have further questions, please contact our Customer Support team, linked at the bottom of this page.

Updated on: 29/12/2022

Was this article helpful?

Share your feedback

Cancel

Thank you!