Account Security
Last updated:
Protect both your CryptoVista account and the external accounts you choose to connect. Security controls can differ by account role and by the features currently available.
1. Sign-in and recovery
Use a unique password or a securely protected Google account. Use a password manager and complete any offered multi-factor checks. For Google sign-in, recovery and Google multi-factor controls belong to Google; for email/password sign-in, use the recovery flow offered by CryptoVista. Do not give support your password, one-time code or recovery secret.
2. Multi-factor authentication
Where the application offers authenticator enrollment, follow the instructions shown there and complete the verification step. Some sensitive features require a recent multi-factor check before they can proceed. Do not assume that enrolling an authenticator enables a recovery method or backup-code feature that is not shown.
3. Sessions and devices
Review the session or device controls offered in settings and sign out on shared devices. If you suspect unauthorized access, end affected sessions where possible and contact support. A changed password, revoked Google connection or browser-data clear should not be assumed to complete every account-recovery step.
4. Read-only exchange keys
Connect only accounts you control. Use a dedicated key with only the permissions described in the connection screen. Do not enable trading, transfers or withdrawals. Follow provider IP restrictions and connection instructions. Disconnect unused connections, then revoke the corresponding key in the provider’s account settings.
5. Research and phishing
Verify the official cryptovista.ai domain and review the destination before entering credentials. Keep secrets out of notes, AI prompts, attachments, screenshots, public posts and support messages. Check the audience before publishing a report or Discover item.
6. Report a suspected incident
Contact bilalalam58@gmail.com with the time, affected route and a redacted description. Stop using a potentially compromised key and revoke it at its provider. The security-reporting page explains what to include for a vulnerability report.