Protection follows the action
Signing in, changing security settings and sending funds are different actions. CarryLane does not rely on one password for all three. The closer an action gets to a withdrawal, the more independent checks it requires.
This architecture also helps during normal use. It lets an investor see when access, destination or fund availability changes, rather than discovering it only in an ending balance.
Sign-in, 2FA and controllable sessions
A password protects sign-in, while an authenticator app adds a separate factor to sensitive actions. Ten one-use recovery codes are issued in case the phone is lost and should be stored separately. Neither authenticator nor recovery codes should be shared with support or anyone else.
The dashboard lists active devices and lets you end one session or all other sessions. Inactive sessions expire after 12 hours, and no session lasts more than 30 days. Changing the password ends other sign-ins.
PIN, email and destination are separate
Withdrawals use a separate six-digit PIN. A one-time emailed code confirms the specific request, while enabled 2FA adds a code from the investor’s device. The server verifies them; entering digits into a screen alone does not send funds.
Funds can be sent only to a verified whitelisted address. A new address has a 24-hour hold, and sensitive security changes trigger a separate safety pause. These windows provide time to detect an unwanted action before an irreversible network transfer.
Controls continue after confirmation
A request is checked against available balance, amount, asset, network, address state and current limits. Where a route supports automatic execution, the system decides without a separate manual approval step. The operation status remains visible in the dashboard.
The activity history separates deposits, credits, fees and withdrawals. Statements let you reconcile a final amount with the events that produced it. Security is not only about stopping mistakes; it is also about reconstructing what happened afterward.
