> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xblu.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Password, two-factor authentication, passkeys, recovery codes, connected devices, the freeze, and what closes an account.

## Password

Changing the password signs your other devices out; the one you change it from stays signed in.
Resetting it from the sign-in page closes every open session.

## Two-factor authentication

A code from an authenticator app, on top of the password. It is required before a first deposit
and before any withdrawal, and asked again for the changes that touch your money or your access.

A **passkey** signs you in with your device's own lock, your face, your fingerprint or its PIN. It
works only on this site, so a copied page gets nothing from it, and it stands for the two-factor
code.

**Recovery codes** are ten single-use codes that open the account if you lose your authenticator.
Store them when they are shown: they are not shown again, and a new set replaces the old one.

Losing the authenticator without a recovery code starts a **recovery of the second factor**, which
removes it after a waiting period announced by email. Withdrawals then wait 24 hours, as after
any change to your security: a password changed or reset, an email change, two-factor turned on
or removed, a passkey added, a recovery code used, the address book turned off, or a freeze
lifted.

## Connected devices

The security page lists every device signed in, with the browser, the system and the date, and
lets you sign any of them out, or every other device at once. A session ended from another device
also stops the browser notifications of that device.

## Security history

Every sign-in and every change to the account's security over the last 90 days is listed, newest
first: the account opened, two-factor turned on, a wrong code entered, a recovery code used, a
device signed out, an email change. If you do not recognise one, change your password now.

## Freeze withdrawals

One control stops every withdrawal and signs every device out, this one included. Positions and
money stay where they are. Lifting the freeze takes a password reset, a sign-in, and the lift in
the security settings; withdrawals then wait one more day. See
[Withdrawals](/money/withdrawals#holds-on-withdrawals).

## Identity

Opening an account and depositing take an email address, a password and two-factor
authentication. Xblu does not ask for identity documents today.

## Closing the account

An account is closed from the settings once it is empty: no money, no open position or order, and
no deposit or withdrawal in progress. Closing is final: every device is signed out and the account
can no longer be signed in to.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.