Why we confirm it's you before connecting a brokerage

Turtleway hasn't launched publicly yet, so the details below describe how this security step will work once the app is live.

When you go to connect a brokerage or investment account for the first time, Turtleway shows a quick "Confirm it's you" screen before the connection screen opens. This is called a step-up authentication check. It's a one-off confirmation, on top of already being signed in, that the person holding the phone is really you.

Why is this step needed?

Connecting a brokerage is one of the most sensitive things you can do in Turtleway: it links a real financial account and pulls in your holdings and balances. Being signed in is enough for browsing the app, but for an action this sensitive we ask you to prove it's you at that moment.

This protects you in the situation that matters most: if your phone is unlocked and someone else picks it up while you're already signed in, they still can't quietly link one of your financial accounts. The extra check stands in the way. It also reflects the security standards that Plaid, our financial-data provider, expects of apps that connect accounts.

How do I confirm it's you?

The app picks the most convenient method your device supports, so most of the time this is a single tap:

• Face ID or fingerprint. If your device has biometrics set up, you'll be asked to confirm with your face or fingerprint. Nothing leaves your device; the check happens on the phone itself.
• A code from your authenticator app. If biometrics aren't available, you'll enter the current 6-digit code from your authenticator app (for example Google Authenticator or Authy).
• Setting up an authenticator, if you don't have one yet. If you don't have an authenticator set up, the app walks you through it right there: install a free authenticator app, scan the code shown on screen, and enter the 6-digit code it gives you. Completing that setup both protects your account going forward and confirms it's you this time.

If a biometric check doesn't work or isn't available, you can always switch to an authenticator code instead.

When does it happen?

• The check appears each time you start connecting a new account, before the Plaid connection screen opens.
• If you cancel the check, the connection screen simply doesn't open and nothing is linked. You can try again whenever you like.
• This applies to setting up a new connection. Refreshing or reconnecting an account you've already linked works differently.

Is this the same as two-factor authentication?

It's related. The authenticator app used here is the same kind of second factor you may already use elsewhere, and if you turn on two-factor authentication for your Turtleway account it uses the same authenticator setup. The difference is timing: two-factor authentication protects the moment you sign in, while this check protects the specific moment you connect a financial account. For more on securing your account, see Signing in, passwords, and account recovery.

Questions?

For more on how linking works and what data is shared, see Connecting your investment accounts. If you have other questions, email us at support@turtleway.io.