# Security & 2FA

_Source: https://docs.neurotrading.io/zh/account/security_

## Two-factor authentication (TOTP)

Neurobot supports app-based 2FA (Google Authenticator, Authy, 1Password, etc.):

1. **Enable:** Settings → Security on the web, or `/profile` → MFA in Telegram.
2. Scan the QR code (or enter the one-time secret) in your authenticator app.
3. Confirm with a first code to activate.

Once enabled, sensitive operations — **SOL/token transfers out**, key exports, and other high-risk actions — require a fresh 6-digit code. 2FA is shared across surfaces: enable it on the web and it protects the Telegram flows too.

Lost your device? Use the reset flow from your profile — expect verification friction; that friction is the protection.

## How your account is protected

* **Login is your Telegram identity** (HMAC-verified) — there's no password to phish, but it also means **your Telegram account's security is your account's security**. Turn on Telegram's own two-step verification.
* **Wallet keys are stored encrypted** and decrypted only to sign transactions you or your automation initiated.
* Sessions are token-based and expire; logging in again is a Telegram approval, not a password.

## Practical rules

* Never share seed phrases or private keys — staff will never ask, in DM or anywhere else.
* Verify the bot's exact handle before interacting; report lookalike bots.
* Use a dedicated trading wallet with only the funds you're actively trading; keep the rest in cold storage.
* Review your wallets' trade histories periodically — everything the platform does on your behalf is logged and notified.