Security

Passwords are stored solely as irreversible cryptographic digests; the original password cannot be recovered from storage.

The connection to the service is encrypted. Each session is a sign-in on a particular device; the “Security” section of the account shows active sessions with the device and time of last activity, and any of them can be terminated.

Two-step sign-in is available: besides the password, signing in requires a one-time code from an authenticator app; ten single-use backup codes are issued when it is turned on. It can be turned off only with the password and a code. Changing the password or the e-mail address requires confirmation with the current password; changing the password signs the account out on all other devices. The “Security” section also shows the sign-in history. No system can be fully secure, so we apply reasonable technical and organisational measures and improve them as the service develops.

Our team’s access to data is limited by role: each member of staff sees only the sections needed for their work. The control panel can be entered only with two-step sign-in; after five wrong attempts sign-in is locked for an hour, after five more for a day, and after that for five days. Every staff action that changes something, as well as every opening of a conversation together with its reason, every search through the text of messages and every data export, is recorded in an internal log that cannot be changed or deleted from the panel.

A telephone number is hidden by default. Communication takes place within the service, which allows a transaction to be conducted without disclosing contact details.

Use a password that you do not use on other websites, do not share it with anyone, and turn on two-step sign-in in the “Security” section.

Review active sessions and terminate those you do not recognise; where access by others is suspected, change the password and sign out of all devices.

Do not move the conversation to third-party messengers before getting to know the seller, do not transfer advance payments to strangers, and do not disclose confirmation codes from emails to anyone, including those presenting themselves as support.

Report suspicious advertisements and users with the “Report” button — this speeds up the review and protects others.