Security policy
How Blocs Finance keeps your funds, your account and your data protected.
Your money is held in escrow
Every exchange locks the funds you send into an escrow hold. The hold is only released when the matching leg settles, and it is refunded automatically if an exchange is cancelled or expires.
Sign-in protection
Sign-in, sign-up, one-time-code and recovery requests are rate limited. After repeated failed attempts a temporary 15-minute lockout applies to that source, which stops automated password and code guessing.
Two-factor authentication
You can protect your account with an authenticator app, an SMS code, or both — you choose which one is asked for first. Ten single-use recovery codes are issued so you can still get in if you lose your phone. A device you verify stays trusted for 30 days.
Devices and sessions
Every device that signs in is recorded with its platform, browser, approximate country and last activity. You can review them at any time and sign out everywhere instantly, which invalidates all sessions across all devices.
App lock
A 4-digit PIN, optionally backed by Face ID or fingerprint, guards sign-in and every withdrawal. The PIN is verified server side and locks temporarily after repeated wrong entries.
Incognito accounts
Incognito wallets collect no email, phone or identity data, so two-factor and identity checks do not apply to them. Instead you receive a one-time account key shown only once. Your username plus that key restores your wallet and pending transactions on any device. We store only a hash of the key and cannot recover it for you.
Immutable audit trail
Wallet movements, admin actions, rate changes and verification changes are written to a hash-chained audit log that cannot be edited or deleted, so any tampering is detectable.
Data handling
Traffic is encrypted in transit and served from the same origin as the app. Access to your records is enforced at the database level, so one account can never read another's data. You can export your data or request deletion from Settings.
Reporting a problem
If you believe your account or a transaction has been compromised, sign out everywhere from Settings and contact support immediately so we can freeze pending settlements.