Security

• Brand passwords are stored only as scrypt hashes. Brand users can turn on two-step sign-in with an authenticator app, with recovery codes kept only as hashes.
• Partners sign in with one-time links sent to their email; there is no partner password to steal.
• Sessions are signed, httpOnly cookies sent only over HTTPS on the live site.
• Within a brand, owners, managers and viewers have different rights, and each brand's data is kept apart from every other brand's.
• Sign-in, events and links are rate limited.

• Network addresses and buyers' emails are kept only as keyed hashes. Partners' tax numbers are encrypted with AES-256-GCM.
• We never ask for or keep card or bank account numbers: partners' bank details stay with Whop.
• Every download of tax files is logged, and only a brand's owners can make one.
• Full details are in the privacy policy and Annex 2 of the data processing agreement.

• Every movement of money is a line in an append-only ledger; nothing is edited or deleted, only reversed with a new line.
• Automatic checks run on the ledger to prove it balances, and a program never pays its partners more than its brand has paid in.
• Incoming sales events and payout webhooks are accepted only with a valid signature. Payout webhooks must also be recent, and the transfer behind each one is read back from Whop before anything changes.

New code runs on separate test networks (devnet and testnet) with simulated money before it reaches the live network. Brands and developers can use the test networks to build and test their integration without touching live data.

If you find a security weakness, email max@viralpayouts.com with “Security” in the subject, the steps to reproduce it, and what an attacker could do. We will reply within two working days and tell you when it is fixed.

• Test only against your own accounts, preferably on a test network. Do not access or change other people's data, and stop and tell us if you do so by accident.
• No denial-of-service, spam, social engineering of our staff or users, or physical attacks.
• Give us a reasonable time to fix the issue before you make it public.

If you follow these rules, we will not take legal action against you for your research, and we will credit you if you wish. We do not run a paid bug bounty yet.

If a breach affects personal data we process for a brand, we tell that brand's owners within 48 hours of becoming aware of it, as the data processing agreement requires, and we tell anyone else affected as the law requires.