Security is a product boundary, not a badge.

Workspace isolation

Every protected CRM request is scoped to the authenticated agency and role. Creator, fan, script, vault, note and employee access is checked server-side. Employee access can be limited to assigned creators, and removing an employee revokes active sessions.

Fansly session isolation

Each creator uses a separate persistent Electron partition. Remote Fansly page code does not receive Revny message-send, vault-sync, diagnostic or filesystem capabilities. Privileged operations run through an isolated preload and fail closed when the exact creator session cannot be identified.

Credentials and sessions

Revny passwords are hashed with a per-password salt. New passwords are checked against a compromised-password corpus using a k-anonymous prefix that never sends the full password or full password hash. Cloud session tokens are stored as hashes server-side and delivered to the desktop app in HttpOnly cookies. Workspace owners can enable encrypted, time-based authenticator codes; enabling or disabling two-factor authentication revokes other sessions. Fansly sign-in state stays in the creator-specific device partition and is not included in the CRM cloud snapshot.

Transport and storage

Production traffic uses HTTPS. Security headers restrict framing, content types, referrers and browser permissions. CRM cloud data is stored through managed infrastructure and access is limited to service-side credentials; no database service key is shipped in the desktop renderer.

Billing boundary

Stripe is the authority for subscriptions, trials, invoices, payment methods and proration. Revny does not store full card numbers. Creator and Pro entitlements are isolated per model and are reconciled from Stripe subscription state.

Diagnostics and support

Anonymous technical diagnostics are off by default. When enabled, only allow-listed error codes, platform family and app version are sent. CRM session tokens, account email, private conversations and fan content are excluded. Support content is sent only when a user submits a support request.

Cloud availability

The current private-beta desktop release is cloud-first and requires an internet connection to verify a session after launch. A short network transition can use already verified state while the app remains open, but a restart during an outage may require retrying before CRM data becomes available. Revny shows a dedicated unavailable state and does not silently replace cloud data with an unverified local database.

Release verification

The Downloads page publishes the exact desktop version, build time, signing state and SHA-256 checksum generated with each installer. Private-beta installers are currently unsigned and the site states this before download. Signed/notarized distribution remains a requirement before Revny calls the release generally available.

Responsible disclosure

Report a suspected vulnerability to security@revny.app. Include affected version, platform, reproduction steps and impact. Do not access other customers’ data, disrupt service or publish sensitive details before Revny has had a reasonable opportunity to investigate.