Security at Couponeau App
Nine layers protect your account — from two-factor authentication and encryption to full audit history and a human incident team. Below is exactly what each layer does and what we ask you to do in return.
Security is a shared job: the platform guards the infrastructure, and a few two-minute habits on your side make an account takeover impractical.
En créant un compte, vous acceptez notre Politique de confidentialité et nos Conditions d’utilisation.
Your personal manager will contact you within 24 hours.
How your account is protected
1Two-factor authentication (2FA/MFA)
Every BrandName account supports time-based one-time passwords (TOTP apps such as Google Authenticator or Authy) and email verification codes. Two-factor authentication is strongly recommended at registration and can be enforced as mandatory in your account settings; clients who run automated strategies keep it permanently on.
What you should do: If you lose your 2FA device, recovery runs through identity verification with the support team — a government ID plus a signed statement — and a mandatory 24-hour cooling-off period before access is restored. Store your backup codes when you first enable 2FA; that is the fastest recovery route.
2Encryption
Data in transit — every page, form submission and dashboard request — is protected with TLS encryption. Data at rest, including your personal records and hashed credentials, is encrypted with modern ciphers on our storage layer.
What you should do: The scope covers registration data, verification documents, account settings and API credentials. The systems responsible are maintained by our infrastructure team and reviewed by an independent security assessor as part of our regular audit cycle.
3Fraud and phishing protection
Official communication reaches you only from our support email address and from inside the platform. Emails from BrandName carry a verification banner showing why you received the message; if a message claims to be from us but lacks it, treat it as fraudulent.
What you should do: Always check that your browser address bar shows the genuine domain before signing in. If a message pressures you to "confirm your password" or "move funds to a safe wallet", it is a scam — forward it to [email protected] and delete it.
4Login notifications
A sign-in from a new device or unusual location triggers an immediate email notification with the time, device type and approximate location. Push-style alerts for suspicious activity — failed logins, repeated password attempts, new API key creation — arrive the moment the system flags them.
What you should do: If you receive a login alert you do not recognise, open the notification, revoke that session from your dashboard and change your password. The alert arrives before an attacker can usually do anything meaningful.
5Device and session management
The Security section of your dashboard lists every active session: device, browser, location and last activity. You can revoke any session with one click, sign out everywhere at once, and set automatic session termination after inactivity — 30 minutes by default.
What you should do: Review the list once a month. Revoking old phones and office computers you no longer use takes seconds and removes the most common way accounts get compromised.
6Account recovery
If you lose access to your email or 2FA device, recovery starts with a request to support from your registered address, followed by identity verification — photo ID and, where needed, a liveness selfie check that matches the verification you completed at onboarding.
What you should do: Recovery has deliberate limits: a cooling-off period applies before withdrawals are re-enabled on a recovered account, and notifications go to all previously known contact points. These constraints are what make account theft unprofitable.
7API key permissions
Exchange connections use API keys with scoped rights: read-only (view balances and history), trade (place and manage orders) and withdrawal (move funds). BrandName requests only the permissions a strategy needs — read and trade — and withdrawal rights stay disabled by default.
What you should do: You can rotate or revoke an API key from the dashboard at any time, and keys are stored encrypted. Never grant an API key withdrawal rights to any service, including ours — a legitimate platform never needs them.
8Audit history
Your account keeps a permanent, searchable log: every sign-in with device and IP, every API connection change, every strategy start or stop, every settings modification and every withdrawal request.
What you should do: The log cannot be edited from the client side, which makes it a reliable record in a dispute. Export it any time as a file — many clients use the monthly export as the basis for their own tax and record-keeping.
9Incident support
If something looks wrong — an unfamiliar session, a missing transaction, a suspected phishing attempt — contact [email protected] from your registered address, or use the in-platform incident form. Our team can freeze account activity while an issue is investigated.
What you should do: Serious incidents are escalated to a dedicated handler who keeps you informed until resolution. For account-takeover attempts, we also guide you through securing the connected email address, which is the usual entry point attackers try first.
Five minutes that make your account unattractive to thieves
- Enable 2FA on the day you register and store the backup codes offline.
- Use a password that exists nowhere else — a password manager makes this painless.
- Keep withdrawal confirmations on, and treat every "confirm your details" email as hostile until proven otherwise.
- Review active sessions and the audit log once a month.
- Never share API keys with withdrawal rights — no legitimate service needs them.
Suspect something? Email [email protected] immediately — the incident team can freeze activity while you regain control. Our AML/KYC policy explains why we verify identity, and the fraud warning page lists current scam patterns.