Home › Legal centre › User Account and Security Policy

User Account and Security Policy

How accounts are protected, and what you must do.

• Passwords must be at least 8 characters and are stored only as salted hashes; we can never see them.
• Repeated failed logins are temporarily blocked.
• Each login requires you to read and accept the current risk notice and terms.
• Administrator accounts can (and should) use two-factor login with an authenticator app and one-time backup codes.
• Sessions end after 7 days or when you log out; you can change your password in Account.
• You must keep your password, one-time codes and backup codes private, not share accounts, log out on shared devices and tell us immediately if you suspect misuse. We will never ask for your password, one-time codes or broker secrets.