Account Security Principles
Wallet and account security#
DeepSafe provides several verification methods that protect different points in the workflow. We recommend enabling all of them.Google Authenticator verification confirms your identity when signing in. Complete the binding on a secure network, keep the recovery information provided during setup, and avoid installing the authenticator on the same device as DeepSafe — if that device is lost, both layers of protection fail at once. Verification codes are time-limited and should never be shared with anyone, including people claiming to be support staff.The Wallet Password unlocks the app and confirms transactions and approvals. It is stored only on your device and is never uploaded to a server, which means DeepSafe cannot reset it for you — if you forget it, the only route is to recover your wallet using your recovery phrase. Choose a password with sufficient length and complexity, do not reuse a password from another platform, and do not store it in a browser or an unencrypted note.App Lock prevents others from opening DeepSafe while you are away from your device. Enable it if your device could be handled by someone else — shared office equipment, devices sent for repair, or use in public places. If a device is lost, deal with your sessions and Team permissions immediately from another device.Biometric Payment lets you confirm payments and approvals quickly using your device's Face ID or fingerprint. Before enabling it, confirm that only your own biometric data is enrolled on the device. If someone else's fingerprint or face is stored there, enabling this feature effectively hands them the ability to confirm payments and approvals.Key shards and recovery phrases#
Key shards and recovery phrases are the ultimate credentials controlling your assets. Losing them means losing the ability to participate in signing; leaking them gives someone else that ability.Never give your key shard or recovery phrase to anyone. DeepSafe staff will never ask you for them under any circumstances. Any request framed as identity verification, recovery assistance, or a system upgrade is fraudulent.Back up away from cameras and networks. Complete backups where there is no surveillance and no one else present. Do not photograph or screenshot the content, do not send it by email, messaging apps, or cloud notes, and do not use public networks.Designate cloud shard backup holders separately. Each of the two cloud key shards can have its own backup holder — a business partner, a Team member, a family member, or another of your own devices. Do not give both cloud shards to the same person, and do not store them alongside your local shard. Once all three shards sit in one place, the point of distributing them is lost.Consider long-term risk when storing backups. Keep backup media somewhere fire-resistant, dry, and inaccessible to others. If you record a recovery phrase on paper, consider making multiple copies stored separately. At the same time, confirm you can actually retrieve it when needed — storing it so securely that you cannot reach it has the same consequence as losing it.Transfer safety#
An on-chain transaction cannot be reversed once broadcast. Verification before submitting is the only effective safeguard.Check the token and network. Confirm that the network you select matches the recipient's. Transfers on a mismatched network usually cannot be recovered.Check the source and destination addresses. Verify the full address character by character, not just the first and last few. Malware exists that alters clipboard contents and substitutes a visually similar address.Check the amount and network fee. Confirm the order of magnitude and decimal places, and confirm the account holds enough to cover the network fee.Send a small test transfer first. When sending to a new address for the first time, transfer a small amount, confirm it arrives, and only then send the full amount.Never use an address from an unverified source. Use only addresses provided by the recipient through a trusted channel, and confirm them through a second channel before the transfer arrives. For recurring counterparties, add the address to your whitelist.Official channels and recognizing risk#
Contact DeepSafe through official channels. Get contact details from the DeepSafe website. Do not use sponsored search results, social media accounts claiming to be official, or links forwarded by others.Never give support staff your key shard, recovery phrase, or verification codes. Legitimate technical support does not need them.Recognize impersonation and phishing. Common signs: someone contacts you first and creates urgency, asks you to act within a narrow time window, directs you to an external link or a tool download, or requests screen sharing or remote access. Treat all of these with suspicion.Act immediately on anything suspicious. If you find a transaction or permission change you did not initiate, check your Team's members and permission settings in the app right away and contact DeepSafe through an official channel. Contain the situation first; investigate afterward.Modified at 2026-08-26 02:51:05
