Security Architecture

1. Data Encryption & Isolation

Security is built directly into our core architecture. All data sent to Onlyfo is encrypted using industry-standard TLS 1.3 protocol. At rest, production artwork and customer asset data are secured with AES-256 encryption within isolated tenant containers. Data payloads transmitted via the Custom API are processed entirely in memory before being securely routed to isolated tenant containers.

2. API Key Cryptography & Authentication

Our platform employs an industry-standard "Reveal-Once" security protocol for API keys (similar to Stripe and AWS). Raw API keys are generated using cryptographically secure pseudo-random number generators (CSPRNG), presented exclusively one time upon creation, and subsequently stored as one-way cryptographic hashes while permanently masked in the management UI. Furthermore, all machine-to-machine endpoint communication strictly enforces HTTP Authorization Bearer Token authentication headers.

3. Gmail Pipeline & Google Cloud Security Architecture

Our automated inbound email ingestion pipeline connects with Google Cloud APIs using defensive, isolation-first architectural safeguards:

• 100% Read-Only Safeguard: Onlyfo operates strictly under gmail.readonly. The platform has zero technical capability to compose, alter, modify labels, or delete client emails from Gmail mailboxes.
• Token Encryption: OAuth2 refresh_tokens are stored securely in MySQL with restricted access; temporary access tokens expire within 60 minutes and auto-renew silently in the background.
• Payload Idempotency & Deduplication: Real-time Pub/Sub push payloads are validated via atomic unique database keys to prevent duplicate order generation or replay attacks.
• Multi-Asset Ingestion & File Sandboxing: Each client graphic attachment is parsed in an isolated sandbox, verified against strict design MIME types (PNG, JPG, PDF, EMB, DST, PES, AI, EPS, SVG), scrubbed of executable scripts, and deduplicated using atomic database keys before routing to tenant storage.

4. Access Controls & Authentication

Onlyfo enforces strict Role-Based Access Controls (RBAC). Agency managers can define explicit permissions for team members, ensuring freelancers and digitized asset processors only access files assigned directly to their workspace queue.

5. Financial & Payout Security

Payout records and earnings tracking utilize immutable audit logging. Payment transfers are conducted strictly through verified ACH wire and Wise integrations using tokenized API authorizations. Dual-ledger records, client CRM details, and invoice logs are isolated within encrypted multi-tenant database partitions.

6. Incident Response & Vulnerability Reporting

We conduct continuous system monitoring and automated vulnerability scans. If you identify a security concern or potential vulnerability, please report it immediately to our security response team at designerv9@gmail.com.