Security at Suretiform
Security is a set of habits, systems and promises working together. This page describes all nine layers that protect your Suretiform account, what each one does for you, and the part you play. It is written for a normal reader, not a security engineer, because security only works when the person it protects understands it.
The short promise: your data is encrypted in transit and at rest, your account is protected by tools you control, every security-relevant event is recorded, and if something ever goes wrong there is a human and a process behind the word "support".
1. Two-factor and multi-factor authentication
A password alone should never be enough to reach your money. Suretiform supports two-factor authentication (2FA) using an authenticator app and SMS codes, and multi-factor prompts on sensitive actions. We recommend the app option: it works without mobile coverage and resists SIM-swap attacks.
Turning 2FA on is optional at registration but strongly encouraged, and it becomes mandatory before your first withdrawal, a deliberate speed bump that stops a stolen password from becoming a stolen balance. If you lose your device, recovery is by verified video call with the compliance team plus identity documents, not by a quick email; slower on purpose, because the delay is what protects you. Recovery codes are shown once when you enable 2FA, and we advise storing them on paper, not in your email.
2. Encryption of data
All traffic between your browser and the platform travels over TLS encryption, and the connection certificate is checked continuously. Personal records and documents you upload for verification are encrypted at rest in the systems that store them, with access limited to the compliance staff who need it for verification and audits. Encryption keys are managed separately from the data they protect and rotated on a fixed schedule.
The scope is deliberately wide: the website, the member dashboard, the verification store, the reporting engine and the backups in between all sit inside it, and each responsible system is named in our internal register so there is no gap where protection is assumed rather than assigned. If a system cannot meet the standard, it does not hold member data, which is a simpler rule to audit than any exception list.
3. Fraud and phishing protection
Official communication comes only from the suretiform.org domain and addresses ending in @suretiform.org. We never ask for your password, 2FA codes or remote access to your device. When we contact you, we include a personal security phrase you chose at registration, so you can verify it is really us, and our alerts never contain links that ask you to log in; they invite you to open the site yourself.
If a message, call or website presses you to act urgently, treat that pressure itself as the warning sign. The Fraud Warning page lists the imitation patterns we know about and how to report new ones within minutes.
4. Login notifications
Every login from a new device triggers an email to your registered address with the time, approximate location and device type. Unusual activity, such as a login from a new country, a password change, or a withdrawal request, generates an immediate alert with a direct link to secure your account. These notifications are one-way: they inform you and never ask for credentials.
5. Device and session management
The security section of your account lists every active session: browser, device, IP address and last activity. You can end any session instantly with one click, which signs that device out everywhere. Idle sessions end automatically after a fixed period, and changing your password invalidates all existing sessions at once. If you lose a phone or laptop, a single visit to this page closes the door behind it.
6. Account recovery
Locked out? Recovery always runs through identity verification: documents, a live check with the compliance team, and a mandatory cooling-off period before sensitive changes take effect. A recovered account keeps its history, and the previous credentials stop working everywhere. This process protects against the classic attack where a criminal "recovers" your account away from you.
7. Rights of connection keys
Where the platform connects to external services on your behalf, each connection key is scoped to the minimum rights it needs: reading account data, executing trades, or initiating withdrawals are separate permissions. Withdrawal rights are never enabled by default on any member key, and every key shows its creation date, scope and last use in your account, where you can revoke it yourself at any time.
In practice, treat keys like house keys: rotate them when a person or device leaves your setup, never paste one into an email or chat even to "check" it, and revoke anything you do not recognise on sight. A clean key list takes a minute to review and removes an entire category of trouble.
8. Audit history
Logins, connection changes, strategy changes, setting updates and withdrawal requests are all recorded with time and channel in a tamper-evident log. You can see your own account's history in the dashboard, and our compliance team reviews aggregate logs for anomalies. If you ever dispute what happened in your account, that record is the shared point of truth.
9. Support during incidents
If you suspect a problem, from a strange login email to a transaction you do not recognise, email [email protected] with "Account security" in the subject line. These tickets are triaged first and answered out of queue. We can freeze withdrawals, force a password reset and lock the account to a single device while we investigate. You will get a named handler, updates at agreed intervals, and a plain-language summary at the end. Serious incidents are reported to the applicable New Zealand authorities where required.
What encryption covers, and whose systems hold what
It helps to know which system is responsible for which slice of your information. Your browser session with the website is protected by transport encryption, so what travels between you and us cannot be read in transit. Your verification documents and personal records live in the compliance store, encrypted at rest and reachable only by the compliance staff processing your case. Trading and balance data sit in the operations systems, where access is role-based and every administrative read is logged. Payment card details never touch our storage at all: they are entered directly with the payment providers and reach us only as a confirmation token, which is why no member of our team could read your card number even if asked.
Backups follow the same rules as live data: encrypted, access-controlled, and tested regularly, because an unrestorable backup is not a backup. When a provider or sub-processor changes, data flows are reviewed before anything moves, and old copies are destroyed on schedule rather than drifting around forgotten.
Your half of the bargain
Platform security stops most attacks; your habits stop the rest. Use a unique password stored in a password manager, enable 2FA on day one, keep your contact details current, and read the alerts we send rather than skimming them. Security questions are always welcome at [email protected], and no legitimate member of our team will ever be offended by you verifying who they are.