Security Architecture
OFAuth is designed with a zero-credential storage architecture—neither your servers nor OFAuth ever store OnlyFans credentials. Credentials are used once during authentication and immediately discarded.Credential Handling
Your Servers
Only store Connection IDs—simple string tokens like
conn_abc123. No credentials, no session data.OFAuth Infrastructure
Zero credential storage. Credentials are used once to establish a session, then immediately discarded. Only active session tokens are stored encrypted.
What You Store vs What OFAuth Stores
| Data | Your Servers | OFAuth |
|---|---|---|
| Connection ID | ✅ | ✅ |
| OnlyFans credentials | ❌ Never | ❌ Never stored |
| Session tokens | ❌ Never | ✅ Encrypted (active sessions only) |
| User content/data | Your choice | ❌ Not stored |
Encryption Standards
All data in OFAuth is protected with industry-standard encryption:- In transit: TLS 1.3 for all API communications
- At rest: AES-256 encryption for session data
Data Flow
OFAuth operates as a transparent proxy. We don’t store OnlyFans content data:OFAuth signs and forwards
We sign the request using the connection’s session and forward to OnlyFans
What OFAuth stores: Connection metadata (status, timestamps), encrypted session data, and usage metrics for billing. What OFAuth doesn’t store: OnlyFans content, messages, media, or user data.
Infrastructure Security
Cloud Infrastructure
Hosted on enterprise cloud providers with SOC 2 Type II certification
Network Security
All traffic encrypted, DDoS protection, WAF-protected endpoints
Access Controls
Role-based access, MFA required, audit logging for all operations
Monitoring
24/7 monitoring, automated alerting, incident response procedures
Session Management
OFAuth automatically manages OnlyFans session lifecycle:| Event | OFAuth Action | Your Action |
|---|---|---|
| Session expires | Attempts automatic refresh | None required |
| Refresh fails | Marks connection as expired | Re-authenticate user via Link |
| 2FA required | Notifies via webhook | Prompt user to re-authenticate |
Compliance Considerations
Using OFAuth simplifies your compliance posture:SOC 2
SOC 2
OFAuth infrastructure is hosted on SOC 2 Type II certified cloud providers. Contact us for detailed security documentation.
GDPR
GDPR
OFAuth processes data as a data processor on your behalf. We provide DPAs upon request and support data deletion requests.
Data Residency
Data Residency
Contact us for information about data residency options for enterprise deployments.
Data Retention
| Data Type | Retention | Notes |
|---|---|---|
| Connection metadata | Until deleted | Status, timestamps, permissions |
| Session tokens | Active connections only | Encrypted, auto-expire |
| API request logs | 30 days | For debugging, no content stored |
| OnlyFans content | Never stored | Pass-through only |
| Webhook delivery logs | 7 days | For retry and debugging |
When you delete a connection via the API, all associated data is permanently removed.