Security, in nine working layers

1Two-factor authentication

Two-factor authentication (2FA) adds a second lock to your account: after your password, you confirm a single-use code generated on your own device. You can enable it for sign-in alone or extend it to sensitive operations such as withdrawal requests and changes to your contact details. We recommend the stricter setting, and your account manager will walk you through enabling it during onboarding.

2FA protects you where passwords are weakest: reuse, phishing pages and leaked databases from other services. A stolen password without the rotating code does not open an account. The feature works with any time-based one-time password app, so you are not tied to a single vendor or a phone number that can be SIM-swapped.

2Encryption of data in transit and at rest

Every connection between your browser and our platform is encrypted with current TLS standards, which prevents interception on shared networks such as café Wi-Fi or public hotspots common around Toronto's transit hubs. Data stored on our side is encrypted at rest, meaning a physical disk removed from a data centre does not yield readable account records.

Access credentials deserve a specific mention: your password is never stored in a form we could read, show you or leak. It is processed through a one-way hash, so even our engineers cannot recover the original text. That is also why account recovery runs through identity verification rather than a support agent reading your password back to you, a practice no legitimate service uses.

3Anti-fraud monitoring

Deposits, withdrawal requests and changes to payout destinations pass through automated screening that looks for the signatures of account takeover and payment fraud: a new device followed minutes later by a withdrawal change, amounts just under reporting thresholds, or payout details that mismatch your verified identity. Flagged actions are held for review rather than silently executed.

This monitoring is deliberately conservative. It will sometimes slow down a legitimate request by a few hours, and we accept that trade, because the alternative is a fast system that occasionally sends a retiree's savings to a fraudster. If a hold ever touches one of your requests, support will tell you exactly which check paused it and what evidence clears it.

4Login alerts

Each sign-in from an unrecognized device triggers an immediate notice to your registered email, including the time, the approximate location derived from the network and the device type. If it was you, the alert is a quiet confirmation. If it was not, it is your earliest possible warning to change the password and contact support.

The alerts list builds over time into a personal access history you can compare against the account audit log described below. We chose email rather than push notifications deliberately: email survives phone replacement and works identically on every platform, which matters when the alert is the one that counts.

5Session control

Sessions expire after a period of inactivity rather than staying open indefinitely, and you can review active sessions in your profile and end any of them remotely. Forgot to sign out on a library computer or a work laptop you returned? Two taps close that door from your phone.

Password changes force a global sign-out, so every other device must authenticate again with the new credentials. Session cookies are scoped, HTTP-only where supported and never carry more than the minimum needed to keep you signed in, which limits what an injected script could do even in a worst case.

6Account recovery procedures

Losing access to an email address should not mean losing access to your investments. Recovery runs through identity verification: a government-issued photo ID, a live check against your KYC record and, where warranted, a call with the compliance team. The process is slower than an emailed reset link because it has to be, and it ends with your contact details updated and all other sessions closed.

The same rigour applies in the opposite direction: nobody can change your registered email or withdrawal details on your behalf without authenticated confirmation from you. A caller claiming to be from O'Shares Invest who asks you to read out codes or approve changes is not from O'Shares Invest; hang up and write to support so the attempt is logged.

7Exchange connection scopes

When you link an exchange account for analysis, the connection uses read-only API keys: our engine can read market data and position summaries, and it cannot initiate a withdrawal, place an order or move anything. The scope is verified at connection time and re-verified periodically, so a key that later gains broader permissions on the exchange side is flagged and disconnected.

Your funds therefore remain where you put them, under the exchange's own protections, and our role stays analytical. This separation is the single most important structural safeguard in the service, and we would rather lose a feature than weaken it.

8Audit history

Every consequential action on your account, sign-ins, deposits, withdrawal requests, alert changes, watchlist edits and contact updates, is written to an append-only audit log with date, time and device. Entries cannot be edited or deleted by support staff, which makes the log trustworthy precisely where trust is hardest: after a dispute.

You can request an export of your own history at any time, and the same records feed the complaint process described on the Complaints page. When a user asks "who changed my withdrawal address on Tuesday", the answer comes from the log, not from memory.

9Incident response and support

When something goes wrong, a defined incident process takes over: containment first, then verification of scope, then direct notification to affected users with plain-language facts about what happened and what to do next. Security events are also documented for the regulators and bodies relevant to our Canadian activity where required.

If you ever suspect a problem with your account, from a strange login alert to a phishing email using our name, write to [email protected] with the word URGENT in the subject line. Security-related messages jump the support queue, and the first question you will be asked is what action, if any, has already been taken in your name.

For related reading: the AML / KYC policy explains identity verification in detail, and the Fraud warning page lists the scams that most often target Canadian investors in our name.