Controls, not
adjectives.

The structural point comes first, because it removes more risk than any control could add: the desk does not hold client funds on an ongoing basis. Conexus is not a custodial exchange. There is no account to fund, no balance to leave value in, and nothing that could be frozen, lent out, rehypothecated or lost in someone else's insolvency. Value is in motion during a trade and at rest in your own custody outside it.

In practice a trade has two legs. You send the crypto leg on-chain from your own wallet to an address confirmed with your trader. We send the fiat leg from the desk's bank account to a bank account in the same name as the verified client — in South Africa by EFT, RTC or PayShap, elsewhere on the rail confirmed before the quote. Both legs are documented in a written confirmation carrying the reference, the asset, the network, the rate, the gross and the net.

Several rules exist purely to defeat payment redirection, which is the most common way money is actually lost in transactions of this size — not by cryptography failing, but by a bank account number being swapped in a message:

• Settlement details are confirmed out of band. Wallet addresses and bank details are read back verbally on a call you initiated, not accepted from a chat message or a document alone.
• Account name must match the verified client. No third-party payments, in either direction, ever. If the name does not match, the payment does not leave.
• Details do not change mid-trade. A message announcing new banking details during a live trade is fraud, without exception. Stop and call the desk on the published number.
• Test first on a large first ticket. A small transfer, confirmed on-chain and acknowledged by the person you expect, before the balance follows.
• Dual authorisation on the way out. One person prepares a payment, a different person releases it, and both actions are logged.

Blockchain transfers are irreversible. That is a property of the technology, not a policy choice, and no desk, network or recovery service can undo one. The controls above exist because that irreversibility means the only workable place to catch an error is before the send button.

Onboarding a client to an accountable institution means collecting exactly the material a criminal would most like to have: identity documents, proof of address, bank details and source-of-funds evidence. The only responsible way to handle that is to hold as little of it as the law permits, for no longer than the law requires, and to be plain about both. The regime described here is South African, because that is where the desk keeps its records.

Data minimisation. We collect what customer due diligence under section 21 of the FIC Act requires, plus what is needed to settle your trade and account for it. We do not collect data speculatively for marketing, we do not buy or sell personal information, and we do not require an account, a profile or a stored payment method to deal with the desk.

Retention. Records of clients and transactions are kept for five years, as sections 22 and 23 of the FIC Act require. That obligation overrides a deletion request for the records it covers — we cannot delete a transaction record on demand, and no compliant desk can. Material outside that scope is not kept indefinitely.

POPIA. Personal information is processed under the Protection of Personal Information Act 4 of 2013: for a lawful purpose you were told about, with appropriate security safeguards under section 19, and with the rights of access, correction and objection that the Act gives you. The information officer is Information Officer — to be confirmed, contactable at support@conexus-crypto.com. If a security compromise affects your personal information, section 22 requires notification to the Information Regulator and to you, and we will make it as specific as the facts allow rather than as vague as the law permits. You may complain to the Information Regulator (South Africa) directly, and you do not need our permission to do so.

Sharing. Information is disclosed where the law requires it — reports to the Financial Intelligence Centre under sections 28 and 29, information accompanying a transfer under FIC Directive 9 of 2024, requests from SARS or a court, and the OECD Crypto-Asset Reporting Framework, which South Africa adopted from 1 March 2026 with the first return due by 31 May 2027 — and to the service providers we need to operate, under contract. Not to anyone else. What each of those means in practice is set out in the privacy policy and the compliance page.

One consequence worth saying out loud: this desk cannot offer you privacy from a tax authority or a financial intelligence unit, and nobody operating lawfully can. If that is what you are shopping for, no page on this site will help you.

If you have found a vulnerability in this website or its endpoints, we want to hear about it and we will not treat a good-faith report as an attack.

Where to send it. Email support@conexus-crypto.com with "Security disclosure" in the subject line. Include what you found, the steps to reproduce it, the affected URL or endpoint, and what you believe the impact is. If you would like to encrypt the report, say so in the first message and we will arrange a key.

What we will do. We aim to acknowledge a report within five business days, tell you whether we can reproduce it, and let you know when it is fixed. We will credit you if you want to be credited and stay quiet if you do not. We do not currently run a paid bug bounty, and we would rather say that than let you spend a week expecting one.

In scope: conexus-crypto.com and the API endpoints served from it.

Out of scope: social engineering of our staff, our clients or our service providers; physical attempts on the office; denial-of-service and volumetric testing; spam or content-injection reports with no security impact; and raw automated scanner output with no demonstrated exploitability. Missing headers or configuration hardening on their own are welcome as observations, but please say what an attacker could actually achieve with them.

What we ask of you. Do not access, modify or store anyone else's data. Do not degrade the service for other users. Do not use a finding to extract funds, and do not attempt to trade or interact with real client transactions. Give us a reasonable opportunity to fix the issue before publishing. Stay within the law that applies to you and to us — good faith is not a defence we can grant you, and we would rather your research stayed clearly lawful.

If instead you have been contacted by someone impersonating the desk, that is not a vulnerability report and it is more urgent: follow the steps on the verify our channels page.