Only what is actually implemented.
This page describes controls that exist in the platform as built. Where something is designed but not yet connected, it says so — because a security page that overstates is worse than none.
How does ChainwatchCrypto protect account data?
ChainwatchCrypto documents only the security controls actually implemented: authentication and session handling, application-level access controls, and defined data-handling and retention rules. Customer digital assets are not held by default. The page describes what is in place rather than an aspirational security posture.
What protects your account.
Password handling
Hashed with Argon2id where available, bcrypt otherwise. Never stored reversibly, never written to a log.
Multi-factor authentication
TOTP authenticator support with single-use recovery codes, stored hashed.
Session management
Server-side sessions, HttpOnly and SameSite cookies, idle and absolute expiry, and revocation from your own device list.
Device and session history
Every active session is listed with device, address and last activity, and can be revoked individually.
Login notification
A notification on sign-in from an unrecognised device, so an unexpected one reaches you quickly.
Rate limiting and lockout
Authentication attempts are rate limited per account and per address, with progressive delay.
Controls in the application itself.
| Control | Implementation |
|---|---|
| Transport | HTTPS enforced, HSTS set, secure cookie flags. |
| CSRF | Per-session tokens on every state-changing request. |
| XSS | Output encoded at render; a content security policy restricts script sources. |
| Injection | Parameterised queries throughout; no string-built SQL. |
| Access control | Role-based, evaluated server-side on every request. A hidden UI element is not a control. |
| File upload | Type and size validated, stored outside the web root, served through an authorising endpoint. |
| Audit logging | Every sensitive action recorded with actor, target, timestamp, address, device and result. |
| Secrets | Held in environment configuration outside the web root; never in client code or version control. |
What is stored, and how it is handled.
We do not ask for and do not store seed phrases, private keys or wallet credentials. There is no field for them anywhere in this platform, and no member of staff will ever request them.
Security incidents affecting customer data are investigated, contained and notified in line with applicable obligations. We will not publish a response-time commitment we have not contractually agreed with you.
If you have found something.
How to report
Email security@chainwatchcrypto.com with enough detail to reproduce the issue. We will acknowledge your report, keep you updated on remediation, and credit you if you would like to be credited.
Please do not access data belonging to anybody else, degrade the service for others, or disclose publicly before a fix is available.