How do you protect my account from unauthorized access?

Passwords must meet length and complexity requirements and are stored as one-way hashes — even our staff can't see your actual password. Inactive sessions automatically log out after a period of idle time. We monitor for unusual login patterns (a sudden new country, multiple failed attempts) and notify you by email if anything looks off. Optional two-factor authentication is available for users who want extra security on their account. If you suspect unauthorized access, change your password immediately and our system ends all active sessions on the account.

The one-way password hashing means that even a complete database breach would not expose your actual password. The stored hash can verify that a submitted password is correct (by hashing it and comparing) but can't be reversed back into the original password. Modern hashing algorithms make brute-force reversal computationally infeasible for any reasonably strong password. Drivers who reuse passwords across sites can use this account confidently — a breach here can't propagate to your other accounts in the way password reuse normally enables.

The unusual-activity detection runs continuously and uses signals like geographic location, device fingerprint, login time patterns, and failed attempt rate to score each session attempt. A login from a new country an hour after a successful login from the home country is suspicious; multiple failed attempts followed by a successful login is suspicious; logins at unusual hours from devices the account hasn't used before are mildly suspicious. The system errs on the side of notifying rather than blocking — most drivers prefer an extra email they can ignore over a locked account that requires support intervention. Drivers who want to upgrade the protection can enable two-factor authentication, which adds a one-time code from an authenticator app or SMS to every loginаутентификации.