> For the complete documentation index, see [llms.txt](https://elvo-exchange.gitbook.io/elvo-exchange-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://elvo-exchange.gitbook.io/elvo-exchange-docs/security/multi-layer-security.md). # Multi-Layer Security Elvo Exchange uses multiple independent verification layers so that compromising one security method does not automatically provide full account access. ## Multi-Layer Security Elvo Exchange uses multiple independent verification layers so that compromising one security method does not automatically provide full account access. ### Security Should Not Depend on One Credential No single password, email account, authenticator, or wallet should be treated as the only line of defense for an exchange account. Elvo Exchange is designed around a simple security principle: > **One compromised credential should not automatically mean a compromised account.** Users can combine multiple independent verification methods for sign-in and withdrawals. These methods include: * Email OTP * Authenticator App * Web3 Connect * Account Password Each protects the account in a different way. *** ### Defense in Depth This security model is commonly known as **defense in depth**. Instead of relying on one security barrier, multiple independent layers must be satisfied before protected actions can proceed. For example: **Password → Email OTP → Authenticator → Web3 Verification** The exact combination depends on the security methods configured by the user. *** ### Independent Security Layers Elvo currently supports three independent verification methods that can be combined for protected account actions. #### Email OTP A single-use 6-digit verification code sent to the verified email associated with your Elvo account. #### Authenticator App A rotating 6-digit code generated independently by Google Authenticator or another compatible TOTP application. #### Web3 Connect Cryptographic verification using a wallet already linked and verified to your Elvo Exchange account. Because these methods use different forms of authentication, compromising one does not automatically provide access to the others. *** ### If Your Email Is Compromised An attacker who gains access to your email may be able to see email-based verification codes. However, if your Elvo Login Security also requires: **Authenticator + Web3 Connect** email access alone is not enough to complete the protected sign-in. The remaining verification methods must still succeed. *** ### If Your Password Is Compromised Knowing your Elvo password does not automatically bypass your configured Login Security. For example, if your policy requires: **Email OTP + Authenticator** an attacker with only the password would still need access to both additional verification methods. If Web3 Connect is also enabled, the required linked-wallet verification must also succeed. *** ### If Your Authenticator Is Compromised Possession of an Authenticator code alone does not necessarily provide access to your Elvo account. If the account requires: **Email OTP + Authenticator + Web3 Connect** the attacker would still need access to the verified email and the required linked wallet. *** ### If Your Email and Password Are Compromised Using multiple factors becomes particularly important when more than one traditional account credential is exposed. If your configured policy includes: **Email OTP + Authenticator + Web3 Connect** access to your email and password still does not satisfy the Authenticator and Web3 verification requirements. This is why Elvo allows users to combine multiple independent factors instead of relying only on email and password. *** ### If Your Wallet Security Is Compromised A linked wallet can be used as a powerful independent verification method, but it should not be the only security layer protecting the account. If your Login Security requires: **Web3 Connect + Email OTP + Authenticator** control of the linked wallet alone is not enough. The attacker would still need to successfully complete the other selected verification methods. *** ### Wallet Recovery Phrase Exposure If your wallet seed phrase or recovery phrase is exposed, the security of that wallet should be considered compromised. However, a compromised linked wallet does not automatically mean that the entire Elvo account can be accessed if additional Login Security factors are required. For example: **Web3 Connect compromised** but: **Email OTP remains secure**\ **Authenticator remains secure** The remaining factors continue to protect the account. You should still immediately secure the affected wallet and review your Elvo account settings. *** ### Login Security Requires Multiple Factors Elvo Login Security requires at least **two verification methods**. You can select: * Email OTP * Authenticator * Web3 Connect You may configure two methods or all three. Every selected factor must be satisfied before the protected sign-in process can complete. [**Manage Login Security →**](https://elvo.exchange/account/login-security) *** ### Three-Factor Login Protection Users who want the strongest available Login Security configuration can enable all three methods: **Email OTP + Authenticator + Web3 Connect** This creates three separate verification requirements: **Something connected to your account**\ Verified email **Something generated independently**\ Authenticator code **Something you cryptographically control**\ Linked wallet Compromising only one of these factors does not satisfy the complete policy. *** ### Withdrawal Protection Is Separate Account access and asset withdrawal are protected by separate security policies. Withdrawal Security also requires at least **two verification methods**. Available methods are: * Email OTP * Authenticator * Linked Wallet confirmation Every method enabled in your Withdrawal Security policy becomes required for each new withdrawal challenge. *** ### Example: Maximum Withdrawal Verification If you configure: **Email OTP + Authenticator + Linked Wallet** then all three verification methods must be completed before the withdrawal can proceed. This means gaining access to only one factor does not automatically authorize asset withdrawal. [**Manage Withdrawal Security →**](https://elvo.exchange/account/security/withdrawal-security) *** ### Login Access Does Not Automatically Mean Withdrawal Authorization An authenticated account session and a verified withdrawal are separate security events. Even if someone were able to gain access to an authenticated session, configured Withdrawal Security still protects the process of moving assets out of the account. This separation is an important part of Elvo's layered security model. *** ### Sensitive Account Changes Are Protected Elvo also applies additional verification to sensitive security changes. Depending on the action and your current configuration, protected changes can require: * Current password * Authenticator code * Email verification * Wallet verification Sensitive actions include areas such as: * Linking a new wallet * Changing security policies * Changing your password * Changing your verified email *** ### Password Changes Revoke Existing Sessions When your Elvo password is successfully changed: **All active sessions are revoked.** Every browser and device must authenticate again. This helps prevent an existing authenticated session from remaining valid after a major credential change. *** ### Email Changes Revoke Existing Sessions Successfully changing your verified account email also revokes all existing sessions. The user must authenticate again using the updated account credentials. This provides another security boundary around a sensitive identity change. *** ### Active Session Control Security is not limited to login verification. Elvo allows you to review authenticated sessions and terminate access from devices you no longer trust. You can: * Review active sessions * Identify the current session * Terminate individual sessions * Terminate all sessions [**Review Active Sessions →**](https://elvo.exchange/account/sessions) *** ### Example Security Scenarios | Compromised Method | Additional Protection Can Still Include | | ------------------ | --------------------------------------- | | Password | Email OTP, Authenticator, Web3 Connect | | Email | Authenticator, Web3 Connect | | Authenticator | Email OTP, Web3 Connect | | Linked Wallet | Email OTP, Authenticator | | Password + Email | Authenticator, Web3 Connect | | Wallet | Email OTP, Authenticator | The exact protection depends on the security policy configured on the account. *** ### Security Requires Independent Control Multi-factor protection is strongest when each factor is kept independent. For example, storing all of the following on the same compromised device can reduce the practical benefit of multiple security factors: * Email access * Password manager * Authenticator * Wallet recovery phrase Where practical, protect critical credentials separately. *** ### Protect Your Wallet Recovery Phrase Your wallet seed phrase or recovery phrase is one of the most sensitive credentials you control. Anyone who obtains it may be able to control that wallet independently of Elvo. Never provide your seed phrase or private key to: * Elvo support * Community administrators * Developers * Moderators * Anyone contacting you through direct messages Elvo account verification does not require you to disclose a private key or recovery phrase. *** ### Protect Your Authenticator Your Authenticator setup key can be used to generate valid TOTP codes. Do not share it with another person. If you believe your Authenticator setup has been exposed, secure your account and update the affected security configuration as soon as possible. *** ### Protect Your Email Your verified email is an important security layer. Use strong security on the email account itself, including the security features provided by your email service. If you suspect that your email has been compromised, do not rely on Email OTP as your only account protection method. Review your Elvo security configuration and active sessions immediately. *** ### Protect Your Linked Wallet A linked wallet is a security credential. Protect: * Private keys * Seed phrases * Recovery phrases * Hardware wallet access * Wallet-device access Before signing a request, confirm that you intentionally initiated the action through Elvo Exchange. *** ### No Security System Is Absolute Multi-layer protection significantly reduces reliance on a single credential, but no security system can guarantee that an account can never be compromised. Security also depends on how users protect: * Their email * Their devices * Their authenticator * Their passwords * Their linked wallets * Their recovery phrases The purpose of Elvo's layered security model is to make a single point of failure less likely to become a complete account compromise. *** ### Elvo Security Principle The security model can be summarized simply: > **Compromising one authentication factor should not automatically grant complete account access or withdrawal authority.** By combining Email OTP, Authenticator, Web3 Connect, Withdrawal Security, and session controls, users can build multiple independent layers around their Elvo Exchange account. [**Review Account Protection →**](https://elvo.exchange/account/security) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://elvo-exchange.gitbook.io/elvo-exchange-docs/security/multi-layer-security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.