Privacy & data handling
We limit stored personal data to what's necessary for compliance and service continuity. Your authentication metadata (timestamps, device identifiers) help us detect fraud and defend accounts. We never share raw credentials.
If you request account deletion, we follow regulatory retention rules and provide a clear timeline for which data will be removed or archived.
Detailed sign-in flow
When you attempt to sign in, our system orchestrates a short multi-step flow. First, your identifier (email/username) is normalized and checked for syntax. If valid, we challenge for your password. On correct password entry, a risk assessment runs in under a second — checking location, device fingerprint, and recent login patterns. Low-risk sign-ins continue straight into the session. For medium risk, we require a second factor such as an authenticator code or hardware key. High risk events trigger account-hold procedures and manual review by our trust team, ensuring suspicious activity is contained before access resumes.
This dynamic flow reduces friction for regular users while protecting against credential stuffing and account takeover. Session cookies and tokens are scoped tightly and set with short lifetimes; refresh tokens are used only when the device proves its identity cryptographically. Device-bound keys and secure enclave storage on modern devices further harden the short-lived tokens from being replayed on other machines.
Recovery & locked account handling
If an account becomes locked due to repeated failed attempts or suspected compromise, our recovery path guides you through identity confirmation steps. These may include email verification, a photo ID check, transaction history confirmations, or voice verification depending on risk. We aim to balance accessibility with security: legitimate users regain access quickly, while attackers are slowed or stopped. During recovery, we provide transparent status updates and an option to freeze outgoing actions until the identity is restored.
Regulatory and audit considerations
NDAX follows industry regulation relevant to financial services and data protection. Audit logs capture authentication events with anonymized device fingerprints for forensic review. We retain logs as required by law and offer customers transparency reports on data requests. Where regulations mandate, we apply enhanced identity verification and reporting safeguards. Regular third-party audits and internal penetration tests help ensure continuous compliance and operational integrity.
Developer access and API safety
For programmatic use, API keys should be treated like passwords — keep them secret and rotate periodically. Our API supports scoped keys that limit permissions and IP allowlisting to decrease risk. Developers can create read-only keys for analytics and highly restricted keys for production integrations. Avoid embedding long-lived keys in public code repositories; use environment secrets and automated secret managers. When building integrations, enforce least privilege and monitor usage for anomalies.
Frequently asked questions
Q: How do I turn on 2FA?
A: Go to Settings → Security → Two-factor authentication and follow the steps to register an authenticator app or hardware key. We also provide one-time recovery codes—store them safely. If you use a hardware key, ensure your browser supports the protocol and register a backup key if available.
Q: I see an unknown device in my active sessions. What now?
A: Revoke the session immediately from Sessions in Security, change your password, and run a malware scan on devices you use to log in. Contact support if you need account freeze assistance. We recommend reviewing recent transaction history as an extra precaution.
Q: Why was I prompted for additional verification after I logged in?
A: The platform performs periodic risk checks. If a later action looks risky — changing security settings or large withdrawals — we ask for re-authentication to confirm it’s really you. This minimizes the window of opportunity for attackers who may have gained temporary access.
Final notes & glossary
Final tips: treat your authentication as an ongoing habit — review permissions quarterly, archive unused sessions, and treat alerts as high priority. Below is a short glossary of terms to help decode messages you might see during sign-in.
- Authenticator app: an app (e.g., Google Authenticator) that generates time-based codes for 2FA.
- Hardware key: a physical security device (USB or NFC) that performs cryptographic challenges.
- Refresh token: a token used to mint new access tokens without re-entering credentials.
If you need direct help, open a support ticket from your account page or email our security team. We're committed to keeping your access safe while minimizing friction — and we welcome feedback on how to improve the sign-in experience.