• Verified digital identity — every account is verified against a government-issued document before money can move. Uploaded identity documents are encrypted at rest with industry-standard cryptography and are never publicly retrievable.
• Industry-standard bcrypt hashing — your password is never stored or logged in plain text. Even our engineers can't read it.
• Brute-force lockout — 5 wrong attempts in 15 minutes from the same IP triggers an automatic time-out. Bots can't guess their way in.
• Strong password policy — minimum 8 characters with letters and numbers.
• In-house auth only — no Google, Meta, or other 3rd-party OAuth. Your credentials never leave our stack.
• Auto-rotating session tokens — silent rotation every 24 hours so a stolen cookie can't live forever.
• Global session revocation — change your password and every device is signed out instantly.

We don't touch raw card numbers. Every payment runs through a PCI-DSS Level 1 certified processor trusted by millions of businesses. Card details never touch our servers.

• Cryptographically signed webhooks — every payment event is verified with our processor's signature so attackers can't fake “payment succeeded” calls.
• Restricted API keys — our backend uses scoped payment-processor keys with the minimum permissions needed.
• 90% / 10% revenue split, automated — artists are paid directly through Square (or Direct Bank Deposit outside Square markets). No manual transfers, no held funds.
• ACH & crypto fallbacks — payment failures gracefully degrade so fans never get stuck at checkout.

Every dollar paid on StardomFans flows through a documented three-window maturity model — the same discipline banks apply to card settlement:

• Days 1–7 · Refund window — buyers can request a refund at any time; funds are held as pending and cannot be paid out.
• Days 8–10 · Treasury grace period — refunds close, but the money is still ring-fenced by the platform. This 3-day cushion absorbs chargebacks and disputes.
• Day 11+ · Matured & released — funds move into the artist's Available balance and the automated payout engine wires their share to their verified bank account.
• Sales-tax segregation — every cent of sales tax collected at checkout is routed to a segregated treasury account and can only be remitted through a signed, dual-controlled release.
• Automated · auditable · tamper-evident — every state transition is recorded in an append-only ledger.

StardomFans invests in original creative work. Our IP-protection layer keeps that work traceable — so if a file ever surfaces outside the platform, we can respond fast.

• Per-download buyer anchoring — every downloaded audio and video file is uniquely tied back to the account that purchased it.
• Brand-authenticated releases — every download is stamped with the StardomFans identifier so authenticity can be verified at a glance.
• IP-recovery workflow — when a leak is reported, our team can generate a signed, prosecution-ready evidence packet for the rights-holder or law enforcement.
• DMCA response — see our Copyright Policy for takedown procedures.

• HTTPS-only — all traffic to stardomfans.com is TLS-encrypted end-to-end.
• Hardened HTTP headers — X-Frame-Options: DENY, X-Content-Type-Options: nosniff, strict referrer policy. Blocks clickjacking and MIME-sniffing attacks.
• CORS lockdown — only requests from our official domain are accepted.
• Secrets in environment variables — no API keys, passwords, or tokens are ever committed to source code.
• Time-to-live (TTL) database indexes — failed login records auto-purge so sensitive metadata doesn't pile up.

• Zero third-party trackers — no PostHog, Google Analytics, Meta Pixel, TikTok/Instagram embed scripts, session recorders, heatmaps or fingerprinting. Verify with your browser DevTools.
• No 3rd-party sign-in — Google, Meta, and Emergent OAuth have all been removed. Login is email + password only, held entirely in our own database.
• No outbound marketing email — StardomFans.com does not send newsletters, drips, or receipts by email. All correspondence flows through the in-app Admin Inbox.
• Privacy-friendly embeds — TikTok/Instagram render as static preview cards, Twitter/X uses react-tweet (no widgets.js), YouTube uses youtube-nocookie.com.
• Minimal data collection — we ask only for what's needed to run your account. No data-broker enrichment, no location tracking, no cross-site cookies.
• No selling, ever — your data is never sold to third parties or ad networks.
• Email enumeration protection — our “forgot password” flow returns the same response for valid and invalid emails so attackers can't fish for accounts.
• Right to delete — request full account deletion at any time. See our Privacy Policy.

• Verified artist badges — we manually verify high-profile artist accounts to prevent impersonation.
• Sponsor tier vetting — sponsors that open branded stores go through a verification queue before listing.
• Community reporting — every post, product, and event has a one-tap report button. Reports are triaged in our admin moderation queue.
• Word blocklist — admin-configurable list of blocked terms enforced at post-creation time. Harassment shortcuts (e.g. “kys”) are blocked out of the box.
• Block / mute any user — one tap from any post. Blocked users disappear from your Community & Trending feeds instantly, only for you. Manage the list any time from Dashboard → Trust & Safety.
• Full audit log — every admin action and sensitive operation is recorded for accountability.

• Managed cloud infrastructure with automatic scaling.
• Database backups via our managed MongoDB provider.
• Status & uptime monitoring — issues are detected and triaged before they affect users.

Every 24 hours, an in-house AI co-pilot runs a full platform integrity sweep — no humans needed. Each report is sealed in our admin audit trail and reviewed daily.

• Account integrity — scans for orphan records, missing emails, broken artist/user linkage, malformed documents.
• Auth anomalies — surfaces unusual spikes in failed logins, locked-out IPs, and session activity vs. baseline.
• Payment trail audit — reconciles processor webhook events with transaction records to detect any drift.
• Content moderation queue — counts pending reports and flags backlogs.
• Plain-English AI summary — a human-readable verdict (“healthy” / “attention needed”) plus prioritised remediation steps, ready for the admin team every morning.
• Tamper-evident reports — every report is timestamped and immutable in our system_health_reports ledger.

Found a vulnerability? We want to know. Get in touch through our Partnerships & Security Contact form with a clear write-up and reproduction steps. We commit to:

• Acknowledging your report within 48 hours.
• Keeping you updated as we triage and remediate.
• Publicly crediting researchers who act in good faith (if you want).
• Not pursuing legal action against good-faith security research on our staging or scoped surfaces.

We're continuously improving our security and privacy posture. Current state:

• PCI-DSS — out-of-scope by design (we never receive card numbers; our PCI-Level-1 processor handles all card data).
• GDPR / CCPA — we honor data-access and right-to-delete requests for all users.
• DMCA — designated agent and takedown process described in our Copyright Policy.