Security
How OnlyValue AI handles your data and your OnlyFans credentials.
Credentials at rest
OnlyFans credentials are encrypted with AES-256-GCM before they reach the database, using a 256-bit key held only in server environment configuration. Ciphertext carries a random 96-bit nonce and a 128-bit authentication tag, so tampering is detected on decryption. No API endpoint returns a stored credential — not to you, not to support. The interface shows a truncated SHA-256 fingerprint so you can identify which key is stored.
Database access control
Every table has PostgreSQL row-level security enabled and forced, with policies keyed to the authenticated user id. Analytics, insights and payment rows are read-only to their owner; all writes go through server code after validation. The credential column is additionally removed from the browser role’s column grants, so it is unreachable even if a policy regresses.
Payments
Plan prices live in server code, never in the request. The client sends a plan id; the server looks up the amount and records it. Provider callbacks are verified with HMAC-SHA512 against an IPN secret, deduplicated in a ledger table so a replayed callback cannot extend a plan twice, and checked against the amount we recorded at invoice time before anything is granted. An unverifiable callback is rejected.
Transport and headers
HSTS with preload in production, a Content-Security-Policy with a per-request nonce and strict-dynamic, frame-ancestors none, object-src none, and a Permissions-Policy that denies camera, microphone, geolocation and payment. API responses are marked no-store and vary on Cookie.
What we do not do
We do not post to your account, message your fans, read message contents unless you enable topic analysis, or share your data with advertisers. The service worker never caches an authenticated response.
Reporting a vulnerability
Email [email protected] with steps to reproduce. We do not pursue legal action against good-faith research that stays within your own account and avoids degrading the service for others.