Funding an account means trusting us with an identity document and a balance. This page sets out the specific controls behind both, rather than asserting that security is a priority.
Identity documents are written to a private disk outside the web root and streamed to authorised reviewers through an access-controlled route, with sandboxing headers that stop a browser from executing anything it is handed.
A one-time code confirms your address before the account is created, and again before any password reset completes. A reset request alone changes nothing.
Credits and debits are written inside a database transaction with the balance row locked, so two simultaneous operations can never produce a figure that does not reconcile.
Sign-in, registration, code requests and password resets are individually throttled, which makes credential stuffing and code guessing impractical rather than merely slow.
The most common and most reasonable question about verification. Here is the full path the image takes.
Text extraction runs locally on your device. The fields are populated before the image is uploaded, and you edit anything that was misread.
The file is written to a private disk that nginx cannot serve. There is no URL that returns it, guessable or otherwise.
An authorised reviewer fetches it through an access-controlled route that sends nosniff and a sandboxing content-security-policy, so nothing in the file can execute.
We keep it for the period our AML obligations require, then delete it. The retention period is set out in the privacy policy.
Full detail in our privacy policy and AML & KYC policy.
Most crypto losses do not involve a broken platform. They start with a compromised email inbox, a reused password or an address pasted from the wrong place. These four habits close the gaps that attackers actually use.
Read the full checklistYour email address can reset your password. Put a unique password and an authenticator app on it before you worry about anything else.
Credential stuffing works because passwords are reused. A password manager removes the need to remember a unique one.
Clipboard-hijacking malware swaps addresses silently. Verify the first and last six characters every time; a broadcast transaction cannot be reversed.
We will never ask for your password, a verification code or a transfer to a "temporary" address. Anyone who does is not us.
If you believe you have found a vulnerability, email support@bullish.jo3.org with enough detail to reproduce it. Please give us a reasonable window to respond before disclosing publicly, and do not access, modify or exfiltrate data belonging to other members while testing. We will confirm receipt and keep you informed of the outcome.
Create an account, verify your identity and choose a plan. Your first daily credit lands the day after your plan is activated.