Trust & security

Deposits are made in USDT on the TRON network to a deposit address issued to you. That address is derived from a wallet OGuard generated and controls. The wallet’s master secret is held by OGuard, encrypted at rest under a dedicated key. Deposited balances are periodically consolidated into an OGuard treasury address.

Money leaving the platform is the path that matters most, so it carries the most controls. Each of the following is in force today.

• A one-time code on every withdrawal. No withdrawal can be created from a session alone. If you have an authenticator app enrolled you are asked for a code from it; if you have not, a one-time code is emailed to your verified address. The amount and the destination you approved are bound into that challenge, so a withdrawal cannot be created for a different amount or a different address than the one you confirmed.
• Manual administrator approval on every withdrawal. Nothing is paid out until an administrator has reviewed and approved the request and the balance debit has landed. Automatic payout is switched off; the payout system refuses to send for any request that is not approved and debited.
• A server-signed, exactly-once payout engine. Once approved, the on-chain payment is built and signed on our servers under a state machine designed so that a crash, a retry, or two servers acting at once cannot produce two payments. The transaction is recorded before it is broadcast, a rebroadcast always replays the same signed bytes, and a database uniqueness constraint backstops the whole path.
• Amount integrity checks. The figure about to be signed is re-compared, in whole cents, against the figure you authorised immediately before signing. Any discrepancy stops the automated path entirely and falls back to manual handling rather than sending a different amount.
• One withdrawal in flight at a time, enforced by a database constraint rather than a screen check, so two simultaneous requests cannot both proceed.
• Velocity limits with an automatic stop. Per-transaction, per-account-per-day and platform-per-hour limits apply to any automated payout. Breaching the hourly limit switches automated payouts off and alerts every administrator.
• A destination warning.If the address you enter looks like an exchange’s pooled deposit address — where a TRC-20 transfer with no memo is usually unrecoverable — you are warned before you confirm. This is advisory: it warns, it does not block.

One clarification, because it is easy to over-read: OGuard maintains an approved-address list for its own treasury, and changing that address requires the root administrator plus an authenticator code. That control protects OGuard’s consolidation address. It does not restrict, and is not a check on, the destination address you withdraw to.

• Your session token is stored in a cookie that page scripts cannot read, and is attached to API calls on the server. It is never exposed to JavaScript running in your browser.
• Two-factor authentication at sign-in is optional: you can enrol an authenticator app, or turn on emailed one-time codes. Enrolling an authenticator issues ten single-use recovery codes — store them somewhere other than the phone holding the app.
• Repeated wrong passwords against your account from one device arm a lockout that lengthens with each further attempt, up to one hour. It is scoped to the device attempting it, so somebody guessing at your email from elsewhere cannot lock you out of your own account.
• Sign-in, registration and password reset are protected by a Cloudflare challenge.
• Signing out ends that session immediately and the token cannot be reused afterwards. If you think a device is compromised, tell support: an administrator can revoke every session on your account at once, and reset your password so the old one stops working.

• Administrator accounts are entirely separate accounts from customer accounts, with separate credentials and separate sessions. Sharing an email address does not share access.
• The administrative interface is on a separate hostname behind an identity gate; an address must be on an allow list to reach the sign-in screen at all.
• Money-critical wallet operations — retargeting the treasury, triggering a consolidation, sending a payout by hand, enabling automated payouts — require the root administrator plus an authenticator code at the moment of the action.
• Administrator actions against a customer account are written to an audit log. If an administrator views the platform as a customer, every change made in that state is recorded as such.
• Credentials and wallet secrets are encrypted at rest with AES-256-GCM under keys held outside the database.

Operating the platform means a small number of third parties handle some of your data on our behalf:

Transactions on the TRON network are public and permanent by design. Anyone who knows your deposit address can see what has moved through it.

When trading has to be paused, the platform enters a maintenance state: orders, deposits and withdrawals are refused with an on-screen explanation while your existing positions and balances remain visible. Changes to your funding requests are emailed to you as they happen.

OGuard does not operate a public status page today. During an incident, updates go out by email to affected customers and through the in-app support inbox. If something looks wrong and you have seen no message, contact support rather than assuming it is known.

If you believe you have found a vulnerability, email support@oguard.io with enough detail to reproduce it. Please report it to us before disclosing it anywhere else, and do not access, modify or exfiltrate data belonging to another customer while investigating.

We do not currently run a paid bug-bounty programme and we do not publish a formal safe-harbour policy, so we will not pretend to offer either. We will acknowledge your report and tell you what we did about it.