Security

Cirtus Trust · 1 Harbour Street, Wilmington, DE

How we protect your account

• Passwords and PINs are stored hashed. Nobody at Cirtus, including staff, can read them.
• Repeated failed sign-in attempts are rate limited.
• Sessions expire automatically after 30 minutes of inactivity.
• Payments require a transfer PIN, and optionally a one-time code and clearance codes.
• Funds for a pending payment are held so the same money cannot be committed twice.
• Every staff action against an account is written to an audit log.

What we will never do

We will never ask for your password, transfer PIN or a one-time code — not by phone, email, SMS or any messaging app. Anybody who does is not us.

What you can do

• Turn on two-step sign-in under Security.
• Use a password you do not use on any other site.
• Review your sign-in history occasionally.
• Freeze a card the moment something looks wrong — you can unfreeze it just as fast.

Reporting something

If you think your account has been compromised, or you have received a message pretending to be from us, contact support@cirtus.online or call +1 800 000 0000 straight away.