Version 2026-10 · Draft for review by US, EU and Swiss counsel before launch

Security at Avatique

What protects your account, your money and your content, and how to tell us about a vulnerability.

1. Your account

Passwords are hashed with Argon2id and must be at least 12 characters. New passwords are checked against known data breaches using a k-anonymity range query: only the first five characters of a hash ever leave our servers.
Two-factor authentication with any authenticator app, plus ten single-use recovery codes stored only as hashes. Codes can't be replayed.
Sign-in attempts are rate limited per network and per account. Every sign-in is logged, and a sign-in from a new device sends you an email.
You can see every device that's signed in and sign any of them out. Sessions end after 14 days without activity, and changing your password signs out every other device.

Withdrawals need two-factor authentication and a fresh code at the moment you withdraw or change payout settings.
A new bank account or wallet can receive money 72 hours after it's added, and we email you as soon as it is. Someone who gets into your account can't quietly move your balance.
Earnings are kept in a double-entry ledger that can't be edited or deleted, only added to.
Card payments are handled by our payment processors. Avatique never sees or stores card numbers.

Managers and chat assistants get their own seats, each with its own login and required two-factor authentication. Seats are limited to the pages and actions the creator chooses.
Payouts, tax details, identity verification and team settings can never be delegated. Every message records who wrote it, and every team change is logged.

HTTPS everywhere with HSTS preload, a strict per-request Content Security Policy, and protection against framing and MIME sniffing.
Media is served through short-lived signed links; images can carry a watermark with the page's address.
Webhooks from payment and verification providers are signature-checked and processed once.
Sensitive fields such as tax IDs and authenticator secrets are encrypted at rest with keys derived per purpose.

Email [email protected] with the details and steps to reproduce. We reply within 3 business days and keep you updated until it's fixed.
Please don't access other people's data, degrade the service or use social engineering. Research that follows these rules in good faith is welcome, and we won't pursue it legally.
Our security.txt is at /.well-known/security.txt.