Security, age checks and records

Accounts and sign-in

• Passwords are stored as Argon2id hashes, never as text. Old weak password hashes from an earlier site are replaced the next time that person signs in.
• Two-step sign-in with an authenticator app or a code by email, with ten one-time recovery codes, for members, models, studios and admins.
• "Keep me signed in" can be ended from any device, and changing a password signs the account out everywhere else.
• You choose how many devices one account may use at once.
• Sign-in, sign-up and other forms are rate limited, with Google reCAPTCHA as an option. Addresses that keep hitting the limits can be blocked automatically for a short time.

Your admin team

• Each admin gets only the pages you allow. Money pages and settings can stay with the main admin.
• Opening ID records, private documents and members' purchases is logged with who looked and when.
• Admin sign-ins end after the number of hours you set, and a password change ends every session.

Your keys and accounts

• Payment providers, the video server, storage, email, ID check and push alert keys are your own accounts, entered in your admin panel.
• Secret keys are stored encrypted and never shown again after saving: the page only says that a key is saved.
• Nothing in the script is tied to our accounts, and what your site earns goes straight to your own payment accounts.

Private files and paid content

• ID documents, verification papers and message attachments are kept outside the public web folder and are only handed out after a permission check.
• Paid pictures and videos are never plain links: each one is checked against who bought it, and files kept in a storage bucket open through links that expire after 60 seconds.
• Uploads are checked for their real file type and saved under names the site makes up, in folders where nothing can run.
• Optional virus scanning of uploads (ClamAV) and optional screening of pictures and videos through a content screening service of your choice. Held files are only shown blurred to your admins.

Money

• Tokens are only added after a signed notice from the payment provider, checked on the server. Prices and amounts come from your database, never from the visitor's browser.
• Every token movement is written to one ledger, each payment is counted once, and refunds and chargebacks have their own records.
• Payouts to models and studios are prepared as batches that an admin checks and sends. Payout details are stored encrypted.

Age checks and ID checks

• An 18+ notice for every first visit, and an age verification wall through AgeChecker.net for the countries or states you choose.
• Models, and every person who appears on camera with them, are checked before they can go live: by your team from uploaded documents, or automatically through Veriff or Persona with your own account.
• Every sign-up records what the person agreed to (age, terms, and face-scan consent for automatic ID checks).

Record keeping

• When a model or performer account is deleted, their ID documents and details are not deleted with it. They are kept for the number of years you set (7 by default) and then removed by the site.
• Identity details from automatic ID checks are stored encrypted and opened only by admins, with every view logged.
• Members can download their own data and delete their own account.

Keeping the site running

• A database backup every night, read back to prove it is complete, with an optional copy in your storage bucket.
• A health page that checks the server, and a list of problems the site found in its own error log.
• Alerts to your admins when one address sends far more requests than a person can, with an optional automatic limit.
• Block single addresses or whole ranges, and close the site with maintenance mode while you work on it.
• Works behind Cloudflare, with visitor addresses read only from Cloudflare's own servers.

Updates

• Every update is signed by us. Your site checks the signature and the file's fingerprint before installing anything.
• Updates install only when you choose, keep your own settings, logo and edits, and can be undone from the admin panel.
• The core of the live rooms is protected and licensed to your domain, so a copy taken from your server does not run somewhere else.

When we host your site

• A firewall that lets in only the web and secure server access, and automatic blocking of password guessing.
• https on every address with certificates that renew by themselves, plus server updates and every FluffCams update.

Found a security problem? Tell us and we will answer quickly. Also see the tech specs.