New-device alerts. TradeOnyx hashes a small device fingerprint from your browser family (Chrome / Safari / Firefox / …), OS family (macOS / Windows / iOS / …), country (from your IP), and the first 24 bits of your IP. The first time a hash shows up for your account, the row is added to your trusted-device list and a heads-up email is sent. Future logins from the same hash skip the email — only the *new* combination triggers it.
Critical-action emails. Always sent (not gated by the toggle), because they confirm an action that just happened on your account: password changed (via Settings or via the reset link), 2FA enabled, 2FA disabled. Silencing them would defeat the breach-detection purpose: an attacker who flips one of these expects you not to notice.
Privacy. Only the SHA-256 hash + the human-readable family labels ("Chrome on macOS", "DE") are persisted. No raw IP is stored. The IP /24 prefix that goes into the hash is irreversible — we can't recover the original IP from a row.
- Why not every login? Because spammy alerts get muted, and a muted alert catches zero attacks. *New device* is the actual signal: an attacker rarely sits on the same browser-family + IP-prefix as you.
- VPN / travel. Switching to a VPN endpoint in another country counts as a new device — you'll get a heads-up. Click through to confirm and the new fingerprint joins your trusted list silently.
- The first device of a new account never triggers a mail. The registration was the authorisation; spamming the user about *their own first login* is noise.
- Critical-action mails are unsilenceable. Even with the toggle off, password change / 2FA on/off still send. By design — the attacker who'd want them off is exactly who you don't want to grant that lever to.
- Trusted-device hygiene. Old laptops you've sold? Public-Wi-Fi café you'll never use again? Revoke the row in Settings. Their next login will trigger a fresh alert.
Toggle the heads-up mails. Open Settings → Security → Sign-in alerts. The switch is on by default. Flip it off if you don't want the new-device email — the trusted-device list still tracks fingerprints, and critical-action mails still send.
Review trusted devices. The list below the toggle shows every fingerprint with its UA family, country, and last-seen date. Click *Revoke* on any row to drop it. The next login from that fingerprint will be treated as new and trigger a fresh alert (if the toggle is on).
You got an alert and didn't expect it. Three steps, in order: (1) change your password right now, (2) check the trusted-device list and revoke any row you don't recognise, (3) make sure 2FA is on (Settings → Security → Set up 2FA). The combination of a fresh password + a revoked rogue device + 2FA shuts the door.
Why TradeOnyx never sends "this isn't you, click here to lock" buttons. Phishing kits use exactly that pattern — click → land on a fake login → re-enter password → done. Our security mails only describe the action and link to your real Settings page; you navigate the rest yourself.