Security Basics

An exchanger handles client money, so security comes first — before accepting any orders. This page covers the mandatory minimum: panel protection, roles, and payment account protection.

Admin panel protection

Two-factor authentication (2FA) — mandatory for the owner and all staff. Use a TOTP app (Google Authenticator, 1Password, etc.) rather than SMS where you have the choice.
Strong unique passwords — via a password manager; the panel password must not be reused anywhere.
IP restriction — if your team has static IPs, enable an allowlist for panel login.
Change default paths — if the platform allows a custom panel login URL, set one.
Action log — regularly review the log of logins and critical operations (detail changes, payouts, markup changes).

Roles and permissions

Don’t work under the owner account for everyday tasks. Create separate roles:

Order operator — exchange processing, manual payouts, client communication; no access to merchant and markup settings.
Finance — reserves, balances, financial statistics; no access to roles and domain.
Content manager — texts, appearance, FAQ; no access to orders and finances.

Principle of least privilege: a role gets only the sections needed for the job.

Payment account protection

Dedicated wallets for the platform. Don’t use personal/primary wallets as working ones. One merchant = one set of details bound only to the platform.
Minimum funds on hot wallets. Keep only the working volume on auto-payouts; sweep the excess to cold storage regularly.
API key restrictions. Grant merchant and exchange keys only the permissions they need (no withdrawal right unless auto-payouts require it).
Auto-payout limits. Set a maximum automatic payout amount; anything larger goes to manual moderation (see Auto-payouts).
Dedicated e-mail. Use a separate mailbox with its own 2FA for exchange, payment system, and monitoring registrations.

Platform API keys

Create a separate key for each integration (website, bot, monitoring, your own scripts).
Never publish keys in client-side code or repositories; if compromised — revoke the key immediately and issue a new one.

Typical threats

Phishing — staff follow a “monitoring support” link and enter the password. Rule: log into the panel only via a saved bookmark, 2FA always on.
Payout detail substitution — a client asks to “change the payout wallet” after creating an order. Rule: order details don’t change after payment; disputed cases are refunds only.
Social engineering against operators — pressure (“urgent, refund without confirmations”). Rule: all refunds and exceptions follow the regulations, with a journal record.

Regular procedures

Monthly: review roles and active API keys, rotate owner passwords.
Weekly: reconcile merchant balances against financial statistics.
After a staff member leaves: immediately block their account and rotate shared keys.

See also