Security Guide
How XMR.Company protects your privacy and how you can stay secure.
Platform Security
XMR.Company is built with security and privacy as foundational principles, not afterthoughts. Here's how we protect you:
95-bit Account Numbers
Your 16-character alphanumeric account number has ~95 bits of entropy, making brute-force attacks computationally impractical even at scale. Combined with rate limiting (5 attempts per 10 minutes per IP on create, 10 on login), automated guessing is effectively impossible.
JWT Sessions with jti Only
Session tokens carry only a unique identifier (jti), not your account number. If a token is somehow stolen, it contains no useful credential and can be revoked instantly.
No Personal Data
We don't collect or store email addresses, phone numbers, names, or any personal information. There is nothing to leak in a data breach.
Edge-Rate Limited API
All authentication endpoints are rate-limited. Brute-force, credential stuffing, and enumeration attacks are mitigated at the network edge.
Your Responsibilities
While XMR.Company handles platform security, your account safety depends on you:
- 1Store your account number securely. Write it down, use a password manager, or store it encrypted. We cannot recover it.
- 2Never share your account number. The only place you should enter it is on the official XMR.Company login page.
- 3Verify the website URL. Always check you're on the legitimate XMR.Company domain before logging in.
- 4Review active sessions regularly. Revoke any sessions you don't recognize from your Account page.
What If Something Goes Wrong?
Lost your account number? Unfortunately, there is no recovery mechanism. XMR.Company is designed so that we cannot recover your account number — this is a security feature, not a bug. If you lose it, create a new account.
For any other issues — suspicious activity, compromised sessions, or questions — use the Support tab in your dashboard to reach our team.