> For the complete documentation index, see [llms.txt](https://elvo-exchange.gitbook.io/elvo-exchange-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://elvo-exchange.gitbook.io/elvo-exchange-docs/security/account-protection.md). # Account Protection Protect your Elvo Exchange account with multiple independent security methods for sign-in, sensitive account changes, and withdrawals. ### Security Center Elvo provides dedicated security controls for protecting access to your account and assets. Open: [**Security Settings →**](https://elvo.exchange/account/security) From the Security Center, you can manage: * Linked Wallets * Authenticator App * Withdrawal Verification * Password * Verified Email Elvo also provides separate controls for Login Security and Active Sessions. *** ### Multi-Layer Account Security Elvo is designed so that sensitive actions do not rely on a single security method. Available verification methods include: #### Email OTP A single-use 6-digit verification code sent to your verified Elvo account email. #### Authenticator App A rotating 6-digit code generated by Google Authenticator or another compatible TOTP application. #### Web3 Connect Verification using a signature from a wallet already linked to your Elvo Exchange account. These methods can be combined for stronger account protection. *** ### Login Security Login Security determines which verification methods must be completed before Elvo creates an authenticated account session. Open: [**Login Security →**](https://elvo.exchange/account/login-security) You must enable at least **two security methods**. Available methods are: * Email OTP * Google Authenticator * Web3 Connect You may enable two or all three. > Every method selected in your Login Security policy must be completed during a protected sign-in. *** ### How Protected Sign-In Works If you sign in using your email and password, Elvo requests the additional security methods you have enabled. For example, a policy using: **Email OTP + Authenticator** requires both verification steps before sign-in is completed. If your policy uses: **Email OTP + Authenticator + Web3 Connect** all three methods must be satisfied. *** ### Wallet Sign-In If you begin sign-in using a linked wallet and **Web3 Connect** is one of your configured Login Security methods, the verified wallet signature can satisfy the Web3 portion of the security policy. You must still complete the remaining enabled methods. For example: **Web3 Connect + Authenticator** If the linked wallet has already been verified during sign-in, the Authenticator step remains before access is granted. *** ### Linked Wallets A linked wallet is a wallet that has been explicitly verified and associated with your Elvo account. Open: [**Linked Wallets →**](https://elvo.exchange/account/security/linked-wallet) Linked wallets can be used for: * Wallet-based sign-in * Web3 Login Security verification * Wallet-based withdrawal confirmation Simply connecting a wallet to your browser does **not** automatically link it to your Elvo account. *** ### Linking a New Wallet To link another wallet, Elvo requires protected account verification. The process can require: * The wallet you want to link * Current account password * Authenticator code, when Authenticator is enabled * Wallet signature After successful verification, the wallet becomes associated with your Elvo account. *** ### Wallet Verification Signatures A security signature verifies control of the linked wallet. It is not the same as sending assets. A normal Elvo wallet-verification signature for login, wallet linking, or withdrawal confirmation should not itself transfer tokens from your wallet. Always review the wallet request before signing. *** ### Authenticator App An Authenticator App provides an independent rotating security code for your account. Open: [**Authenticator →**](https://elvo.exchange/account/security/authenticator) Elvo supports standards-based TOTP authentication, including Google Authenticator and compatible applications. Authenticator codes contain: **6 digits** and change automatically over time. *** ### Enable Authenticator To enable Authenticator protection: 1. Open Authenticator in Security Settings. 2. Confirm your current password. 3. Add the provided setup key to your authenticator application. 4. Use **Elvo Exchange** as the account name. 5. Enter the current 6-digit code. 6. Confirm setup. Authenticator becomes available as a security method after verification succeeds. *** ### Protect Your Authenticator Setup Key Your Authenticator setup key can be used to generate valid verification codes. Treat it like a sensitive security credential. Do not: * Send it to another person * Post it publicly * Share it with someone claiming to be Elvo support * Store it in an unsecured public location *** ### Disabling Authenticator Disabling Authenticator requires: * Your current password * A valid current 6-digit Authenticator code If Authenticator is currently required by Login Security or Withdrawal Security, remove it from those security policies first. This prevents an active security policy from depending on a verification method that no longer exists. *** ### Withdrawal Security Withdrawal Security protects assets leaving your Elvo account. Open: [**Withdrawal Security →**](https://elvo.exchange/account/security/withdrawal-security) At least **two independent verification methods** must be enabled before withdrawals can be made. Available methods include: * Email OTP * Authenticator App * Linked Wallet confirmation *** ### Every Enabled Withdrawal Method Is Required Withdrawal Security is not a fallback system where you choose one method at withdrawal time. Every method enabled in the policy becomes required for each new withdrawal verification. For example: **Email OTP + Authenticator** requires both methods. If you configure: **Email OTP + Authenticator + Linked Wallet** all three must be completed before the withdrawal can proceed. *** ### Linked Wallet Withdrawal Confirmation If Linked Wallet confirmation is enabled, the required wallet must sign the withdrawal verification request. This confirms that the withdrawal was authorized using a wallet already associated with the account. A different wallet cannot substitute for the linked wallet required by that withdrawal verification. *** ### Password Protection Your account password remains an important account credential even when additional security methods are enabled. You can manage it from: [**Change Password →**](https://elvo.exchange/account/security/password) Current password requirements include: **Minimum:** 10 characters\ **Maximum:** 128 characters Use a password that is unique to Elvo Exchange. *** ### Changing Your Password Changing your password requires verification of your current account credentials. If Authenticator is enabled, an Authenticator code is also required. After a successful password change: **All active Elvo sessions are revoked.** You must sign in again. This helps prevent previously authenticated browsers or devices from remaining active after a credential change. *** ### Forgot Your Password If you cannot provide your current password, use the account recovery process instead. [**Forgot Password →**](https://elvo.exchange/forgot-password) A successful password reset also requires you to authenticate again using the new password. *** ### Verified Email Your verified email is used for important account functions including: * Account sign-in * Email OTP * Security verification * Account notifications You can manage your email from: [**Change Email →**](https://elvo.exchange/account/security/email) *** ### Changing Your Email Changing your account email is a protected action. The process can require: * Current password * Authenticator code, when enabled * New email address * 6-digit code sent to the new email The email address is changed only after the new address is successfully verified. *** ### Session Protection After an Email Change After a successful email change: **All active sessions are revoked.** You must sign in again using the updated account information. This prevents existing authenticated sessions from remaining active after a major account credential change. *** ### Active Sessions You can review devices and browsers currently authenticated to your account. Open: [**Active Sessions →**](https://elvo.exchange/account/sessions) A session may display: * Browser * Platform * Sign-in method * Session start time * Expiration time * Wallet used for wallet sign-in, when applicable * Location, when available *** ### Session Location Location information is shown only when reliable location metadata is available. If Elvo cannot determine the location, the session may display: **Unknown location** Location should therefore be treated as supporting information rather than the only way to identify a session. *** ### Terminate a Session If you see a browser or device you no longer use, you can terminate that individual session. If you terminate your current session, you will be returned to the sign-in page. *** ### Terminate All Sessions Elvo also provides an emergency control to terminate every active account session. This includes the session on the device you are currently using. Use this if: * You signed in on a device you no longer control * You suspect unauthorized account access * You want every browser and device to authenticate again [**Review Active Sessions →**](https://elvo.exchange/account/sessions) *** ### Recommended Account Protection For stronger account protection: 1. Use a unique password for Elvo Exchange. 2. Enable Authenticator. 3. Link only wallets you control. 4. Configure at least two Login Security methods. 5. Configure at least two Withdrawal Security methods. 6. Review Active Sessions regularly. 7. Terminate any session you do not recognize. 8. Keep your verified email account secure. *** ### Never Share Security Credentials Elvo support does not need your confidential authentication credentials to assist you. Never provide another person with your: * Password * Email OTP * Authenticator code * Authenticator setup key * Wallet private key * Seed phrase * Recovery phrase These credentials should remain under your control. *** ### Security Settings You can review the current protection methods attached to your account at any time from: [**Account Protection →**](https://elvo.exchange/account/security) Keeping your Login Security, Withdrawal Security, Authenticator, Linked Wallets, verified email, and Active Sessions properly configured provides multiple independent layers of protection for your Elvo Exchange account. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://elvo-exchange.gitbook.io/elvo-exchange-docs/security/account-protection.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.