Security at Spirit AI
Your account is protected by several layers that work together: verification of your identity, encryption of your data, monitoring of every session and a clear process when something looks wrong. This page explains each layer in plain English, what we do on our side and what you can do on yours.
1. Two factor and multi factor authentication
Spirit AI supports two step verification (2FA) using a one time code sent to your email or generated by an authenticator app on your phone, and multi factor confirmation for sensitive actions such as changing withdrawal details. We strongly recommend enabling 2FA on the day you open your account, and every personal manager will walk you through the setup during your first call.
2FA is optional but strongly advised; without it, your password alone protects your account. If you lose access to your second factor, recovery is possible only through the support team after we verify your identity, as described in section 6 of this page. Never share your one time codes with anyone, including people claiming to call from Spirit AI: our staff will never ask for them.
2. Encryption of data
All traffic between your device and the platform travels over TLS encryption, the same standard used by Ghanaian banks for online banking. Data stored on our systems, including identity documents you upload for verification, is encrypted at rest and kept in systems with role based access: only the compliance staff who must see a document to verify it can open it, and every opening is logged.
The scope covers your registration details, verification documents, transaction records and communication with support. Encryption keys are managed separately from the data they protect, and key rotation is performed on a regular schedule by the infrastructure team.
3. Fraud and phishing protection
Official communication from Spirit AI comes only from the spirit-ai.org domain and from [email protected]. Any message announcing bonuses, asking for your password or urging you to move funds to a "safe account" is not from us, whatever sender name it displays. We publish our verified contact channels on every page of this site so you can always check.
When your personal manager first contacts you, they will confirm your identity using details you entered at registration, never details you have not given us. If a caller knows your name but asks for passwords, one time codes or MoMo PINs, end the call and report it to us immediately. Our fraud warning page lists the cloned sites and known scams reported so far.
4. Login notifications
Every sign in from a device or browser your account has not used before triggers an automatic alert to your registered email, showing the time, the approximate location and the device type. Alerts about suspicious activity, such as several failed password attempts or a sign in from an unusual country, are marked clearly so you can act fast.
If you receive an alert you do not recognise, change your password at once, end the unknown session from the dashboard as described below, and write to [email protected]. Fast reporting lets us freeze withdrawals on the account while we verify what happened, which in most cases stops any loss before it starts.
5. Devices and session management
The security section of your dashboard lists every active session: the device, browser, IP address and the time of the last activity. You can end any session with one click, which is useful when you have signed in on a public computer, a friend's phone or a device you no longer own.
Sessions end automatically after a period of inactivity, so an open browser tab cannot keep your account accessible indefinitely. After three consecutive failed password attempts the account is temporarily locked and can be unlocked through your email, a small delay that defeats automated password guessing.
6. Account recovery
If you lose your password or your phone, recovery always starts with identity verification: you write to [email protected] from your registered email where possible, answer questions about your account activity, and in most cases provide a short video or a photo of your ID document matching the one used at registration. This is deliberate friction: it must be hard for a stranger to become you.
Until verification is complete, withdrawals on the account remain on hold while deposits and monitoring continue unaffected. Most recovery cases are finished within one business day. If verification fails, the account stays protected and we will tell you exactly what evidence is missing rather than leaving you guessing.
7. API key permissions
Connecting your Spirit AI strategies to an exchange happens through API keys with limited permissions. The platform works with read only keys (to observe balances and prices), trade keys (to open and close positions) and, only where a method you chose requires it, withdrawal keys. We recommend granting the narrowest permission that the strategy needs, and disabling any key you are not actively using.
Keys you create are stored encrypted, are never displayed in full after creation and can be revoked instantly from the same screen. Your personal manager can review your permission set with you and trim anything broader than necessary.
8. Audit history
Your account keeps a chronological audit log you can open yourself: sign ins and sign outs, exchange connections and API key changes, every change to your strategies and settings, deposits, withdrawals and their statuses. The log cannot be edited or deleted by anyone, including our staff, which makes it the single source of truth when a question arises.
We encourage users to review the log at least once a month, the same way you check a bank statement. If any entry looks unfamiliar, the audit record gives our support team everything needed to investigate precisely, without making you reconstruct events from memory.
9. Support during incidents
If you suspect unauthorised access, a mistaken withdrawal or any security problem, report it at once to [email protected] with the subject "Security". The first step, taken within minutes of a credible report, is usually a protective block on withdrawals while we verify the situation; your funds and strategies stay visible the whole time, so a block never costs you information.
From there the case is escalated to the security lead, and you receive a named contact who updates you at least daily until the matter is closed. We will tell you what happened, what was affected, what was done about it and what we recommend you change, in that order and in plain English. Security incidents are also reviewed monthly to fix the root cause, not only the symptom.
Security is a shared effort. We maintain the locks described above; keeping your password unique, your 2FA active and your scepticism healthy is your side of the bargain. If you are ever unsure whether a message or call is genuinely from Spirit AI, stop and ask us through the official channel first.