> For the complete documentation index, see [llms.txt](https://worldxc.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://worldxc.gitbook.io/docs/product/accounts-and-security.md).

# Accounts & Security

This page defines how WorldX protects users against account takeover and operational abuse.

#### Purpose

Account compromise is one of the most common causes of loss. The account system must:

* Reduce takeover probability
* Reduce takeover impact
* Provide clear recovery and dispute pathways without enabling social engineering

#### Key Definitions

* **Session**: An authenticated device/browser instance.
* **Security event:** A sensitive change (password reset, MFA reset, new device, API key creation).
* **Cooldown**: A time-based restriction after security events.
* **High-risk action:** Withdrawal, API trading enablement, sensitive profile changes.

<figure><img src="/files/NsadFxqeeS6peWyt17Y9" alt=""><figcaption></figcaption></figure>

#### Account States

WorldX uses explicit user states because feature access depends on risk and compliance constraints:

* **Unverified**: Limited access
* **Verified (Tiered):** Broader access (tier rules defined by compliance posture)
* **Restricted / Under Review:** Limited actions due to risk signals or compliance requirements
* **Suspended**: Actions blocked pending resolution

WorldX publishes what each state allows and the escalation path.

#### Authentication Baseline

**WorldX requires:**

* Strong password handling
* MFA support (TOTP recommended)
* Session management (view + revoke sessions)
* Alerts for anomalous logins (policy-defined triggers)

#### High-Risk Action Protection

WorldX protects withdrawals and sensitive actions through layers:

* MFA enforcement
* Cooldown after security changes
* Optional withdrawal allowlists (recommended for serious users)
* Anomaly detection (new device + withdrawal, unusual patterns)
* Manual review triggers for high-risk events

Threshold details remain private, but the enforcement categories are public.

#### Account Recovery

Recovery is treated as high risk. WorldX recovery must:

* Require strong identity verification (tier-dependent)
* Log recovery events as security events
* Enforce cooldowns after recovery before withdrawals
* Provide transparent case tracking for users

#### What Users Will Always See

Users can always view:

* Active sessions
* Recent security events
* Withdrawal history and status
* Whether the account is restricted and why (reason codes when allowed)