Security
Security at Senerum is layered: something you know, something you have, and systems that watch for anything unusual. This page explains each layer, what it protects, and what to do when something goes wrong. It is written to be read, not filed.
1. Two-step and multi-factor verification
Two-step verification (2FA) adds a second gate to your account: after your password, you confirm a one-time code generated by an authenticator app on your phone. Senerum supports time-based one-time password (TOTP) apps such as those standard on modern phones, and we recommend enabling 2FA on the day you register, before your first deposit. Multi-factor options may be offered for higher-balance accounts at your manager's suggestion.
Turning 2FA on is strongly recommended for every user, and required before certain sensitive actions such as changing withdrawal details. It is the single most effective protection against stolen passwords, because a password alone no longer opens the account.
Recovery: when you enable 2FA you are shown backup codes. Store them offline, printed or written in a safe place. Each code works once if you lose your phone. If you lose both the device and the codes, recovery is possible only through identity verification with our support team, described in section 6 below.
2. Encryption
Data in transit between your device and Senerum is encrypted with modern TLS; the padlock in your browser is the visible sign. Data at rest, on the systems that hold your account records and documents, is encrypted on storage that sits in access-controlled environments. Encryption keys are managed separately from the data they protect, so a copy of a database alone is of little use to an attacker.
The scope covers personal details, identity documents you upload for verification, session tokens and platform settings. Payment card details for deposits are handled by the payment providers themselves, VISA, Mastercard, PayPal, Apple Pay and Google Pay, and are never stored on Senerum systems. Responsibility for each layer is assigned to named systems teams, and encryption configuration is reviewed as part of routine security audits.
3. Fraud and phishing protection
Fraud protection starts with knowing who is genuinely speaking to you. A lookalike domain is easy to miss on a phone screen, so we state it plainly: Senerum operates one official web address, senerum.co.uk. Email from us comes only from addresses ending in @senerum.co.uk. Any message referencing your account from any other domain is not from us.
Verified messages from Senerum never ask for your password, a two-step code or your full card number. Where a message needs to prove it is genuine, for example a manager confirming your identity on a call, you can ask them to send a verification note through the platform's internal message centre, which only the real account holder can see.
You can add a protective code of your own: choose a word with your manager that we record on your account. Any legitimate caller from Senerum will know it. If a caller does not, end the call and write to [email protected]. Suspected clone sites can be reported through our fraud warning page, which also lists what to do in the first ten minutes after sharing details with the wrong party.
4. Login notifications
Every sign-in from a device or browser your account has not used before triggers an email notification to your registered address, showing the time, approximate location and device type. Reviewing these messages takes seconds and catches unauthorised access early, which is when it is most containable.
Suspicious activity, a sign-in from an unusual country, repeated failed password attempts, or a change to your email or withdrawal details, generates an additional alert and can freeze the sensitive action until you confirm it. If you receive a login alert you do not recognise, do not ignore it: change your password immediately, sign out of all sessions (section 5) and contact support so the account can be examined.
5. Device and session management
Your account settings list every active session: which devices and browsers are signed in, when each was last used and from roughly where. You can revoke any session instantly, which signs that device out and invalidates its credentials. After revoking, change your password if you believe the session was not yours.
Sessions expire automatically after a period of inactivity, and idle sessions on shared or public computers should always be closed manually. Signing out is a small habit that prevents a large class of problems, particularly on machines used by others.
We recommend a monthly review: open the session list, confirm every entry is yours, and revoke anything you do not recognise. It takes less than a minute.
6. Account recovery
Losing access to your account, or suspecting someone else has it, follows a defined path. First, contact support from your registered email so we can tie the request to your record. Identity verification then applies: you may be asked to confirm recent account activity, provide the document used at registration, or complete a live selfie check against your stored verification photo. These steps exist so that an attacker cannot use recovery to take over an account.
Recovery has deliberate limits. We will never bypass verification because a caller is in a hurry, and we cannot restore an account to different ownership details without full re-verification. During recovery, withdrawals are held until the account is fully secured, a constraint we apply for your protection even when it is inconvenient.
7. API key rights
Where the platform connects to an exchange on your behalf, it does so through API keys with explicit, separated permissions. Trading keys can read market data and place or close orders. Information keys can read balances and history. Withdrawal permissions are deliberately separated: a key that trades cannot move funds off the exchange, wherever the exchange supports that separation.
You can see which rights each connection holds in your account settings, and connections you do not recognise should be revoked and reported. We never request keys with broader permissions than their task needs, and any partner that does should be treated with suspicion.
8. Audit history
Your account keeps a tamper-evident log of the events that matter: sign-ins, new devices, changes to your password or contact details, connections and disconnections of exchange integrations, and every change to your strategy settings, with timestamps. The audit history exists for two reasons: it lets you reconstruct what happened on your account, and it lets our team do the same when investigating an alert or a complaint.
Reviewing the log occasionally is good practice, in the same way as checking a bank statement. Entries you do not recognise are worth a question to support, and early questions are cheaper than late ones.
9. Incident support
If you suspect a security incident, compromised password, unrecognised session, suspicious message claiming to be from us, the fastest channel is email to [email protected] with "Security" in the subject line. Security reports are prioritised over general enquiries, including outside normal support hours.
On receiving a credible report, we can lock the account against withdrawals, force-reset sessions and begin an investigation, and we will tell you what we have done at each step. You can request a temporary block yourself at any time; a block can be lifted only after identity verification. Expected communication order: acknowledgement within one working hour during support hours, a first substantive update within 24 hours, and written closure of the investigation with findings you can keep. Where an incident affects many users, we publish a plain-English note on the platform rather than contacting each person individually.
Security is a shared effort. We maintain the walls; you guard the door. The protections on this page work best when 2FA is on, notifications are read, and anything odd is reported quickly rather than hoped away.