Not a list of security words. The controls below are ones you can switch on, see, or check for yourself — and where we hold a registration, we give you the number to look it up.
Turn on an authenticator app or SMS codes from your profile. A password alone will not get anyone into your account once it is enabled.
Every account is verified before it can hold or move money — a person for a personal account, and the owners and controllers for a business one.
Withdrawals go only to addresses you have added and confirmed in advance, so a compromised session cannot invent a new destination.
Every account has transaction and balance limits, shown in the app rather than discovered when something is declined. Ask support to review them.
On business accounts, payroll runs and payment batches sit in a queue until somebody with authority releases them. Nothing leaves on one click.
Customer money sits in segregated accounts with regulated financial institutions, apart from the company's own operating funds.
Registered with FINTRAC as a Money Services Business
Registration No. C100000392. You can check it yourself on the public FINTRAC MSB registry — we would rather you did than took our word for it.
That registration is the only certification we claim. Where an independent audit or attestation is completed in future, it will be named here with the body that issued it and the period it covers.
What happens to the information you have to give us in order to be verified.
Traffic between your device and Vaulltix runs over TLS. The site is served over HTTPS only.
Documents you upload for verification are stored to meet the record-keeping periods FINTRAC requires, and are not used for anything else.
What is collected, why, how long it is kept and who it can be disclosed to is set out in the privacy policy — including how to ask for a copy or a correction.
Most accounts are lost through the person, not the platform. These three things matter more than anything above.
It is the single change that most reduces the chance of someone else getting in. Profile, then Security.
Go to your accountWe will never ask for your password, a 2FA code, or a card PIN — not on chat, not by email, not on the phone. Nobody legitimate will.
Check with supportA payment you do not recognise, a login you did not make, a message that felt off. Reporting early is what makes it recoverable.
Report itTell us straight away — a payment you do not recognise, or a message claiming to be from us. It is easier to fix early.