Security | Groman Pro

1. Two-factor authentication (2FA/MFA)

The platform supports two-factor authentication through an authenticator app (the kind that generates six-digit codes every thirty seconds) and by text message as an alternative. We recommend the app: SMS codes can be intercepted if your line suffers a fraudulent SIM swap.

Enabling is optional at registration, but it becomes mandatory to enable withdrawals and to connect exchange access keys. If you lose your device, recovery goes through identity verification with the support team: nobody can skip that step, not even you, and that is how it should be.

2. Data encryption

All data travelling between your device and the platform is encrypted with TLS in transit, including forms, sessions and dashboard calls. Sensitive data at rest (IDs, financial data, access logs) is stored encrypted in segregated systems, with role-based, logged access.

The encryption scope covers user databases, verification document storage and audit logs, with periodic access reviews and secure-deletion policies once data is no longer needed.

3. Fraud and phishing protection

The platform's official domain is groman-pro.org: type it directly into your browser and bookmark it. We never send sign-in links and never ask for passwords, verification codes or card details by phone, chat or email. Any message doing so is not from us.

As an extra layer, you can set a verification word for support calls: when assisting you, the manager confirms it so you know you are talking to Groman Pro and not an impostor. Report any suspicious message to [email protected] and see the fraud warning.

4. Sign-in notifications

Every sign-in from a new device or location triggers an email notification with the access details: date, time, device type and approximate origin of the connection. If you recognize the access, do nothing; if not, the email itself contains the link to close that session and change your password.

Alerts for suspicious activity (repeated failed attempts, changes to contact details or withdrawal settings) use the same mechanism. The idea is simple: no important action on your account should happen without you knowing within minutes.

5. Device and session management

Your dashboard shows the list of active sessions: desktop browser, mobile app, tablet. Each entry shows when it started and from where, and you can close it individually or close all but the current one with a button. It is the first recommended action if you lose a device or notice something odd.

Inactive sessions close automatically after a period without activity, and a full session reset is mandatory after certain sensitive events, such as a password change or a withdrawal-details update.

6. Account recovery

If you lose access (forgotten password, stolen phone), recovery goes through identity verification with the support team: account details, proof of identity and, depending on the case, a brief video call. The process is deliberately strict because it is also the barrier stopping whoever tries to steal someone else's account.

Deliberate limitations: contact emails and withdrawal details are never changed in a single interaction, and accounts with 2FA are not recovered with the email alone. Write to [email protected] to start the process.

7. Access key permissions

When you connect an exchange through access keys, each key can carry three permission levels: read (view balances and movements), trade (execute orders) and withdraw (move funds out). The platform's default setup requests only read and trade: the withdrawal permission is not needed for strategies to work.

You can view and revoke active keys from your dashboard at any time. Direct advice: if a feature does not need a permission, do not grant it. Smaller attack surface, smaller possible damage.

8. Audit history

The platform logs, with date and time: sign-ins, exchange connections and disconnections, strategy and parameter changes, contact-detail modifications and withdrawal requests. That history is available in your dashboard and is the version of facts both parties can consult for any doubt or discrepancy.

Records are read-only: neither you nor any employee can edit them. If you need an extract for a clarification or a complaints procedure, request it and we deliver it complete in writing.

9. Security incident support

If you suspect unauthorized access, act in this order: close all sessions from the dashboard (or with support's help if you cannot get in), change your password from a trusted device and write immediately to [email protected] with the subject "Security incident". The team can freeze the account preventively during the investigation.

Escalation follows a clear order: support opens the case with a number, passes it to the security team for analysis and, if funds are at risk, coordinates actions with the exchanges and processors involved. We keep you informed at every step: immediate acknowledgment and a first update within the next business day.

What you can do today

Five fifteen-minute actions that close the doors attackers use most. Turn on two-factor authentication with an authenticator app instead of SMS. Change your password to a long, unique passphrase stored in a password manager. Review the dashboard's active session list and close the ones you do not recognize. Confirm your recovery email is one you actually check, because that is where access alerts arrive. And bookmark the official site address so you never enter from links received in messages.

After that, repeat the session review once a month and read the access alerts when they arrive: three seconds that catch a problem before it grows. None of these measures costs money, and together they close the vast majority of real paths attackers use against financial platform accounts.

Technical security does not remove market risk: your investments can lose value even with a perfectly protected account. Also read the risk disclosure and the identity verification policy.

Your account and data security