Security at Dromela

1 Two-factor sign-in (2FA / MFA)

Dromela supports two-factor authentication through an authenticator app that generates time-based codes, and through a one-time code sent by SMS to your verified mobile number. The authenticator app is the stronger option, because SMS messages can be diverted by someone who convinces a mobile carrier to move your number.

Two-factor sign-in is enabled during onboarding and we strongly recommend you keep it on. You will be asked for a code on every new device and before sensitive actions such as changing your email address or approving a withdrawal. Switching it off requires a code first, so a person who only knows your password cannot disable it.

If you lose the device that holds your codes, use the backup codes you were shown when you set it up, or follow the recovery process described in section 6. Store backup codes offline and never in an email draft or a notes app that syncs to a shared account.

2 Encryption

Traffic between your browser and Dromela travels over TLS, which means the connection is encrypted and tamper-evident. Any attempt to load the site over an unencrypted connection is redirected to HTTPS.

Data at rest, including account profile information, verification records and stored API credentials, is encrypted in the database and backup systems that hold it. Exchange API secrets receive an additional layer of protection and are never displayed again after you save them.

Access to production systems is limited to staff who need it for their role, requires multi-factor authentication and is logged. The infrastructure team is responsible for key management, while the security lead reviews access rights on a regular schedule.

3 Fraud and phishing protection

Our official domain is dromela.org and our official email domain is the same. Messages from any other domain, even one that looks similar, are not from us. We will never ask you for your password, a two-factor code or your exchange secret key over the phone or by email.

You can set an anti-phishing code in your security settings. Once set, every genuine email we send includes that code, so a message that lacks it can be ignored. Verified messages are also visible inside your dashboard, which you should treat as the source of truth when in doubt.

If you suspect a clone of our site or a scam message, read the fraud warning and forward the message to [email protected] without clicking anything inside it.

4 Login notifications

We email you whenever your account is accessed from a device we have not seen before. The message states the approximate location, the time and the browser type, along with a link to end that session immediately if it was not you.

You can also choose to receive push notifications in the mobile browser or the app for certain events: a failed login burst, a changed password, a new API key, or a withdrawal request. Suspicious activity, such as sign-in attempts from two distant locations within minutes, can trigger a temporary hold until you confirm it is you.

5 Device and session management

The security page inside your account lists every active session with the device, location and the time of last activity. Anything you do not recognise can be revoked with one click, which also signs that device out of the platform.

Sessions end automatically after a period of inactivity, and changing your password ends all sessions except the current one. On a shared or public computer, always sign out manually, because closing the tab is not the same as ending the session.

6 Account recovery

If you cannot sign in, start with the password reset link sent to your registered email. If you have lost access to both your email and your second factor, contact support and be ready to verify your identity with the same kind of documents you used at onboarding.

Recovery is deliberately slower than a normal login. A support specialist will check your identity against the account record, and for a period after recovery some actions, such as withdrawals to a new destination, may be limited. This protects you from someone who is trying to take over your account by posing as you.

7 API key permissions

To connect an exchange you create an API key on that exchange and paste it into Dromela. Exchanges allow you to choose what a key can do, usually three things: read balances and history, place trades, and withdraw funds.

We ask you to enable read and trade permissions only. Never enable withdrawal rights for a key you give to any third-party service, including ours. If you can, restrict the key to our published IP addresses on the exchange, which makes a leaked key far less useful to an attacker.

You can revoke a key on the exchange at any time, which immediately stops the platform from acting on that account.

8 Audit history

Your account keeps a time-stamped history of important events: sign-ins and failed attempts, connections and disconnections of exchanges, changes to strategies and settings, and changes to security options. You can review it at any time.

The history is read-only, which makes it useful both for your own checks and for any investigation, because it shows what actually happened and when.

9 Incident support

If you believe your account has been compromised, use the emergency option in your security settings to lock the account, or email [email protected] with the subject line "Account compromised". Support is available every day, and security incidents are prioritised above routine requests.

After a report we lock the account, revoke sessions, review recent activity with you and agree the steps needed to restore access safely. We will tell you what we know, what we do not yet know, and what we are doing about it.