Security at Taman Yieldholm is layered: controls on your account, encryption on your data, monitoring on activity, and a team that acts when something looks wrong. This page explains each layer openly, including what we ask you to do as a user.
1. Two-factor authentication (2FA/MFA)
We support time-based one-time password (TOTP) authentication through apps such as Google Authenticator or Authy, with email codes as a backup option. 2FA is not compulsory at registration, but we prompt every user to enable it before the first deposit, and the dashboard shows your account's protection status at a glance.
Recovery sequence: if you lose your phone, sign in with your password, request a backup code by email, then issue a new 2FA secret and retire the old one. One-time backup codes are also provided whenever you rotate secrets; store them offline in a safe place rather than as screenshots on the same phone.
2. Data encryption
Personal data is encrypted at rest using AES-256 on the primary storage systems, and every connection between your browser and the platform is protected by TLS in transit. The systems handling KYC identity data, transaction history and payment records each keep separate encryption keys, so access to one system does not expose your entire profile.
Scope of application: the user database, KYC document storage, audit logs and the payment interface are four separated areas with their own access controls. Staff receive access strictly by role, and every access is logged.
3. Fraud and phishing protection
Our official domain is taman-yieldholm.org and its subdomains. We never ask for your password, 2FA codes or full card numbers by email, phone or chat. Every official transactional email carries a case reference code you can cross-check inside your account; if an email shows no such code, it did not come from us.
Precautions: type the platform address manually or use a bookmark you created yourself, watch out for lookalike spellings, and check any "guaranteed profit" claim against our Fraud warning page. Confirm recipients inside your account before authorising any transfer.
4. Login notifications
Every new sign-in from an unknown device or browser triggers an email notification with the approximate time, device type and estimated network location. If that activity was not you, one link in the email opens the session page to end access and change your password.
Unusual activity such as a change of withdrawal address, a new API key activation or repeated failed sign-in attempts also raises an alert. We would rather interrupt you with a notification than let an important event pass silently.
5. Device and session management
The active sessions page lists every device with its last sign-in time, and you can end any session individually or all at once. Web sessions expire automatically after a period of inactivity, and signing back in always requires the full password regardless of how long you were active before.
After any withdrawal or security-settings change, sessions on other devices are reset in stages as a precaution. Review your session list at least once a month; it takes less than a minute.
6. Account recovery
Recovery starts with identity verification: registered email, the date of birth on file, and document confirmation through a short KYC check. We deliberately make recovery slower than a normal login, because speed in this process favours criminals, not you.
Limits during recovery: withdrawals and payout-detail changes are blocked until the process completes. Reach us at the official address [email protected]; the team works Monday to Friday, 9:00–18:00 MYT (excluding public holidays) and usually replies usually under one business hour.
7. API key rights
API keys linking the platform to an exchange can carry three permission levels: read only (checking balances and prices), trading (sending buy and sell orders) and withdrawal (moving funds out). For normal use we recommend read and trading permissions only, with low daily amount limits at the start.
Withdrawal keys, when genuinely required, must be protected by an address whitelist that locks a few hours after being set. All keys can be switched off instantly from the settings page, and changing permissions requires 2FA confirmation.
8. Audit history
The audit record stores sign-ins (successful and failed), API connections, strategy changes and every security-settings change, complete with timestamps and device identifiers. No one, including our own staff, can edit these records, and they are kept separately from day-to-day operating systems.
Use this history to verify your own actions: if a monthly report shows a trade you do not remember, compare it with the audit log before drawing conclusions. Two-way transparency only works when both sides read the same record.
9. Incident support
If you suspect your account has been compromised, contact [email protected] with the subject "INCIDENT". The team will temporarily lock the account within the same working day, freeze withdrawal requests not yet processed, and start an investigation together with you.
Communication sequence: acknowledgement within one business hour, the first update before the end of the working day, then periodic updates until resolution. Where needed, the case passes to the Client Support & Compliance department with a written report. For general complaints that are not security incidents, the process is on the Complaints page.
Security is ongoing work, not a one-time feature. Penetration tests and preventive updates run on a regular schedule, and this page is revised whenever new controls are introduced.
Your part of the bargain
The strongest platform controls lose their value if the account side stays weak, so treat this checklist as part of the product. Use a password that exists nowhere else, ideally generated and stored by a password manager. Turn on 2FA before your first deposit, not after something goes wrong. Treat every unexpected email or call claiming to be from us with suspicion, and verify through the address you saved rather than a link someone sent you.
Review your active sessions and recent audit entries once a month. Two minutes of checking closes the window in which a stolen session or a changed payout detail could do real damage. If anything looks wrong, the fastest safe response is the "INCIDENT" route described above: lock first, investigate second. Nobody legitimate will ever rush you into skipping that step.