Security and account safety
How Fansflow connects OnlyFans and Fansly accounts without passwords, how sessions and content are protected, what the AI is allowed to do and how your team stays in control.
- No passwords You sign in to the platform yourself. Fansflow receives a session, never the password.
- Encrypted sessions Sessions, proxies and bot tokens are stored encrypted with AES-256-GCM.
- AI inside your limits Only approved folders and prices, stop topics you set, takeover in one click.
- Delete at any time Remove a connected account and its synced chats and content are deleted with it.
An AI chatter works inside your models’ accounts, and those accounts are your business. This page explains exactly what Fansflow can access, how we protect it and what you control. If something here is unclear, ask us on Telegram.
Connecting an account without a password
OnlyFans
OnlyFans does not allow automated sign-in, so Fansflow never asks for an OnlyFans login or password. You sign in on onlyfans.com in your own browser, as usual, and the Fansflow Connect browser extension passes that session to your cabinet. The extension can only read onlyfans.com, fansly.com and the Fansflow cabinet. It sees no other sites.
Fansly
Fansly can be connected in two ways. The first is the same as OnlyFans: sign in on fansly.com and pass the session through the extension. The second uses Fansly’s own management sessions for agencies: in the Fansly Creator Dashboard, open Management, create a session and paste the link into Fansflow. Either way the model’s password is never involved, and a management session can be revoked from Fansly at any time.
Taking access back
Access lives exactly as long as the session. If you sign out of the platform, end the session or change the password, Fansflow loses access until you connect the account again. You can also remove the account from the cabinet with one button.
How Fansflow works with the platform
- One account, one session. Each connected account uses only its own session. Requests go to the platform the way the browser sends them when the model works on the site herself.
- Your proxy, if you use one. You can give each account its own proxy, so its traffic comes from the address you choose. Proxy addresses are stored encrypted, like sessions.
- No actions you did not allow. The AI writes messages and sends PPV within your rules. It does not publish posts, change account settings, delete content or touch payouts.
No third-party tool can guarantee how a platform treats an account, and anyone who promises that is guessing. What we can do is keep the account’s activity close to how its owner works and give you full visibility into everything the AI does.
How your data is protected
- Encryption at rest. Platform sessions, proxy addresses and Telegram bot tokens are encrypted with AES-256-GCM before they are written to the database. They are decrypted only at the moment a request is made.
- Encryption in transit. Everything between your browser, the cabinet and our servers goes over HTTPS.
- Content recognition. When you turn it on, the AI looks at photos and videos in the vault folders you selected, so it knows what it is selling. Files are sent to dedicated GPU servers over an encrypted channel with a one-time certificate for each server, and are processed in memory without being saved to disk. Recognition never runs on folders you did not select.
- Separated by agency. Each agency’s accounts, chats and content are visible only to its own team. Team roles limit what each member can see and change.
- No passwords for your team either. Team members can sign in through Telegram, so you do not have to share logins inside the agency.
What the AI can and cannot do
- It sells only from vault folders you allowed and keeps every price inside the range you confirmed.
- It counts a tip or purchase only when the platform shows it. A fan saying “I just sent you $50” changes nothing.
- When a fan raises a stop topic, such as meeting in person, the AI stops, leaves the chat to a person and sends you a Telegram alert.
- Fans on your ignore list are never messaged by the AI, so your best spenders can stay with your best chatters.
- In copilot mode nothing reaches a fan until a person presses Send.
- Before going live, you can test the agent in a private sandbox, where you play the fan.
Seeing everything the AI does
Every message the AI sends is visible in the cabinet next to the rest of the conversation. Telegram alerts tell you about sales, stops, rule hits and a low balance, so you do not have to watch the screen to know what is happening.
Report a vulnerability
If you think you have found a security issue in Fansflow, message us on Telegram or write to fansflowai.team@gmail.com and tell us what you found. Please do not access other customers’ data or disrupt the service while testing. We will confirm we received your report, keep you updated while we fix it and credit you if you would like.