Your account holds your trading history, your licences and your payouts. This page explains how we protect it, and how to tell us about a weakness if you find one.
Passwords. We never store your password, only a strong one-way hash of it. When you choose a password we check, without ever sending it anywhere, that it has not appeared in a known data breach.
Two-factor authentication and passkeys. You can add a code from an authenticator app, and sign in with a passkey: Face ID, your fingerprint or Windows Hello. A passkey works only on the real TierAlba address, so a fake page cannot use it.
Devices you control. In Settings you see every device signed in to your account and can sign any of them out at once. Changing your password signs out every other device.
Alerts. When your account is used on a new device, we email you straight away, with a button that secures the account in one press if it was not you.
Protection against guessing. After repeated wrong passwords or codes, sign-in attempts pause for that account, whichever addresses they come from. You can always reset your password to get back in.
Confirmation for what matters. With two-factor on, changing your payout wallet, turning two-factor off or deleting your account also needs a fresh code.
Payments and data. Card payments are handled by Stripe: card numbers never reach our servers. Every connection is encrypted, and our database is closed to the outside, reachable only by our own servers.
If you believe you have found a security weakness in TierAlba, write to us at info@tieralba.com with the subject Security report. Please include:
· what you found and where (the page or address);
· the steps to reproduce it;
· what an attacker could do with it.
We confirm that we received your report within three working days, keep you updated while we work on it, and tell you when it is fixed.
We will not take legal action against research that follows these rules:
· use only accounts you own or have permission to test;
· do not access, change or delete other people’s data, and stop as soon as you reach any;
· no denial of service, spam, social engineering or physical attempts;
· give us reasonable time to fix the issue before you share it publicly. We suggest 90 days.
Reports without a demonstrated impact on our users, such as: missing headers or best practices with no working exploit, rate limits on public pages, clickjacking on pages without sensitive actions, self-XSS, email sender settings, issues that need an outdated browser or a compromised device, and automated scanner output.
We do not run a paid bug bounty yet. With your permission, we are glad to thank you by name for a valid report that helps us protect our users.
Our security contact is also published at /.well-known/security.txt, following RFC 9116.
Security contact: info@tieralba.com
Website: tieralba.com