Security of your account

Two-factor authentication (2FA) adds a second key to your login: after your password, you confirm a six-digit code generated on your phone. Zing markbit supports authenticator applications and codes delivered by e-mail. The method is optional at account level, but we recommend it to every user and it is required before certain sensitive actions such as adding a new withdrawal destination.

Recovery is deliberately human. If you lose your device, contact support from your registered e-mail, verify your identity through our checks, and the team will guide the 2FA reset. The process takes longer than a password reset on purpose, because convenience here would be an attacker's shortcut.

Data moving between your browser and the platform travels over encrypted connections, so a listener on the network cannot read your password or personal details. Data at rest, the copies stored on our systems, is encrypted on the storage layer with keys held separately from the data itself.

The scope covers the systems that genuinely need your information: the account service, the verification pipeline and the support desk. Other subsystems receive anonymised or partial identifiers only. Access to decrypted data is limited to roles whose duties require it, and those accesses are logged.

Our official domain is zing-markbit.org, and messages from the platform come from addresses ending in @zing-markbit.org. We never ask for your password, your 2FA codes or your full card number by e-mail, chat or phone. When we need to confirm identity, we do it by referencing information already on your account, never by collecting secrets from you.

Verification messages we send carry a protective code phrase that you set with your manager. If a caller cannot repeat your phrase, end the call and write to [email protected]. Treat look-alike domains and urgent pop-ups as fraud, and report them; the fraud warning page lists the patterns we see most often.

Every sign-in from an unrecognised device triggers an e-mail notification with the time and an approximate location derived from the network used. Suspicious patterns, such as attempts from a new country within hours of your last session, raise an internal alert and can freeze the login until the activity is confirmed.

Notifications are one-directional by design: they inform you and never contain links that ask for credentials. If a notification describes a login you do not recognise, change your password immediately and tell support, who can force-close every active session on the account.

The dashboard lists your active sessions with device type and start time. You can end any session from any device, which is useful when a phone is lost or a shared computer was used by mistake. Sessions opened on public computers expire automatically after a short idle period.

Trusted devices can be remembered so routine logins stay quick, and a remembered device can be revoked in the same list. Removing a device also clears the remembered-state cookie on it the next time it connects, closing the loop rather than leaving a stale door.

Recovering access starts with identity verification, not with secret questions. You write to support from your registered e-mail, provide the documents described on the AML and KYC page, and a specialist compares what you supply against the records held. Enhanced checks apply when the registered e-mail itself is no longer accessible.

To protect you, recovery has limits: it cannot be used to change the withdrawal destination added within the previous days, and repeated failed attempts lock the recovery channel for a cooling-off period. These frictions exist because a recovery process that is too easy is a burglary tool.

Connections between Zing markbit and exchanges run on keys you can scope by permission: read only, read plus trade, or read, trade and withdraw. The platform requests the narrowest set its functions need, and the dashboard shows each key with its exact permissions so nothing is granted silently.

Our standing advice is to withhold withdrawal permission wherever a strategy can operate without it. A key that cannot move money out limits the damage of any compromise to trading activity, and profits remain reachable through your account rather than through the key.

Your account keeps a running audit trail: logins and their origin, exchange connections established or removed, strategy activations and deactivations, and changes to settings or personal details. The trail is visible to you in the dashboard, so you can reconstruct what happened on your account without asking us first.

Records are retained according to the schedule on the privacy page and support can export your section of the trail on request. In disputes, this history is the shared source of truth for both sides, which protects you as much as it protects us.

If you suspect your account is compromised, write immediately to [email protected] with the subject line "security". The account is frozen while the report is examined, sessions are closed, pending withdrawal requests are held, and a specialist walks you through password and 2FA rotation step by step.

Escalation follows a fixed order: first responder, security specialist, then the responsible lead for cases that need it. You can expect an acknowledgement quickly during support hours and a named contact for the whole case, with updates as each check completes rather than one silent wait for a verdict.