Platform Security
How we protect your data, your money, your account and your content on OtakuOshi. Certified payment infrastructure, data encryption, identity verification, anti-scraping protection, financial privacy and a responsible vulnerability disclosure programme.
Our approach to security
OtakuOshi handles personal data, biometric identity verification, financial transactions, exclusive digital content and private communications between creators and fans. That responsibility means security cannot be an add-on: it has to be the foundation on which everything else is built.
This document explains the technical and organisational measures we apply to protect the platform’s users. It is not an exhaustive technical document (we do not publish implementation details that could facilitate attacks), but it is a transparent description of what we protect, how we protect it and what you can do to strengthen the security of your account.
OtakuOshi’s security framework is complemented by the Privacy Policy (data processing), the Ethics Policy (protection of individuals), the Active Response Policy (incident management) and the Terms of Service.
Areas of protection
OtakuOshi’s security covers six critical areas that directly affect creators and fans.
Payments and transactions
Payments are processed through PCI DSS Level 1 certified providers, the most demanding standard in the payments industry. Credit and debit cards are tokenised: OtakuOshi never stores your full card number. Transactions are encrypted end to end. Real-time fraud detection with pattern analysis.
Accounts and access
Passwords are stored using irreversible cryptographic hashing (never in plain text). Secure sessions with expiring tokens. Detection of suspicious access (new locations, unrecognised devices, brute-force attempts). Automatic temporary lockout after multiple failed attempts. Email verification at sign-up.
Creator content
Anti-scraping and anti-bot measures to hinder automated bulk downloading of content. Contractual prohibition on using content to train AI models (Terms of Service). Monitoring of anomalous download patterns. DMCA process for the removal of pirated content on external sites (DMCA Policy).
Identity verification
Identity and age verification handled by specialised, certified third-party providers. OtakuOshi does not store or access biometric data: it is handled exclusively by the provider under a confidentiality agreement. Government-issued ID verification with a real-time selfie. Detection of fraudulent documents.
Financial privacy
OtakuOshi charges appear on bank statements under a generic, discreet descriptor, with no reference to the platform’s name or the type of content purchased. Fans’ financial privacy is protected at all times. More details on the payouts page.
Infrastructure and data
TLS 1.2+ encryption for all communications between your browser and the platform. Data at rest is encrypted on our servers. Regular encrypted, geo-redundant backups. Internal access restricted under the principle of least privilege: only the personnel who need it can access data, according to their role.
Payment security in detail
OtakuOshi does not process payments directly. All transactions are routed through PCI DSS Level 1 certified payment processors, the highest level of certification under the Payment Card Industry Data Security Standard. This means your financial information is handled to the same standards applied by major banks and international processors.
Tokenisation: when you enter your card, the number is converted into a token (a unique identifier with no value outside the system). OtakuOshi works with tokens, never with your actual card number. Even if someone gained access to our systems, they would not find any card numbers.
Fraud detection: payment processors run real-time fraud analysis: address verification (AVS), security code (CVV), velocity checks (multiple purchases in a short time), geolocation and machine learning based on known fraud patterns. Suspicious transactions are blocked automatically.
Discreet descriptors: the charge on your bank statement shows a generic name, with no mention of OtakuOshi or the type of content. If you share a bank account with other people, they will have no way of telling what you bought from the statement.
Protecting creators’ content
OtakuOshi creators publish exclusive digital content (photo sets, manga, illustrations, videos, audio) and need to know that content is protected. No platform can guarantee that piracy is impossible, but we can make bulk downloading harder, act quickly when it happens and give creators the tools to defend their work.
Anti-scraping and anti-bot: we apply technical measures to detect and block bots, scrapers and automated bulk-download tools. We monitor anomalous download patterns (for example, an account downloading hundreds of files in minutes) and respond with temporary suspension and review.
Prohibition on AI use: the Terms of Service expressly prohibit using OtakuOshi content to train artificial intelligence models, generative adversarial networks (GANs), diffusion models or any machine learning system. This prohibition applies to users, third parties and any entity that accesses the content.
Action against piracy: if a creator finds their content on an external site without authorisation, they can request a DMCA takedown through the DMCA Policy. OtakuOshi assists the creator throughout the process and may act as the takedown agent when necessary.
Watermarks and restrictions: creators can choose to apply watermarks to their public previews. Paid content is served with restrictions that make direct capture harder, although we recognise that no technical measure is foolproof against a user determined to copy.
Identity verification and biometrics
OtakuOshi requires identity verification for creators who publish R-18 content (in accordance with the USC 2257 regulations) and age verification for fans who access adult content. These processes are critical to the platform’s security and to the protection of minors.
How it works: verification is carried out through a specialised, certified third-party provider. The user uploads a photo of their government-issued ID and takes a real-time selfie. The system compares both images, verifies the document’s authenticity and confirms the user’s age.
What OtakuOshi does not store: biometric data (facial recognition, document image) is handled exclusively by the verification provider. OtakuOshi receives only the verification result (approved/rejected) and the minimum data necessary (name, date of birth, country). We do not store or access biometric images.
If you decline biometrics: if you prefer not to use facial recognition, you can verify yourself with alternative documentation through manual review. The process is slower but equally valid. More details in the Privacy Policy.
What you can do to protect your account
Platform security is a shared responsibility. These are the practices we recommend to all OtakuOshi users:
Use a strong password: use a unique password for OtakuOshi that you do not use on any other service. Combine uppercase and lowercase letters, numbers and special characters. A password manager is the best tool for this.
Keep an eye on your sessions: log out on shared devices. If you receive a sign-in notification from a location or device you do not recognise, change your password immediately and contact hello@otakuoshi.com.
Do not share credentials: never share your password, your session token or your verification data with anyone. OtakuOshi will never ask for your password by email or by message.
Watch out for phishing: check that the URL is otakuoshi.com or fans.otakuoshi.com before entering your credentials. If you receive a suspicious email claiming to be from OtakuOshi, do not click any links: forward it to hello@otakuoshi.com so we can verify it.
Report suspicious activity: if you notice anything unusual in your account, your payment activity or another user’s behaviour, report it through the complaints page or write to hello@otakuoshi.com. The sooner we know, the faster we can act.
Incident response and data breaches
If a security breach occurs that affects users’ personal data, OtakuOshi follows a defined response protocol:
Immediate containment: isolation of the affected system, blocking of compromised access and preservation of evidence for the investigation.
Assessment: determination of the scope (what data was affected, how many users, what type of information), the cause and the risk to users.
Notification: if the breach poses a risk to users’ rights and freedoms, affected users are notified as soon as possible, with an explanation of what happened, what data was compromised, what measures we have taken and what they can do to protect themselves. The competent data protection authority is notified in accordance with the GDPR (72 hours) or other applicable law.
Resolution and improvement: remediation of the vulnerability, strengthening of security measures and review of the incident to prevent recurrence. Significant incidents are documented in the transparency report.
Responsible vulnerability disclosure
If you discover a security vulnerability in OtakuOshi (in the web platform, the API, the payment gateway, the server infrastructure or any other component), we ask that you follow our responsible disclosure protocol:
Do not exploit it beyond what is necessary to confirm it exists. Do not disclose it publicly until we have had an opportunity to fix it. Write to seguridad@otakuoshi.com describing the vulnerability, the steps to reproduce it, the potential impact and your contact information.
We will acknowledge receipt within 72 hours and provide a remediation status update within 7 days. Where appropriate and with your consent, we may offer public recognition (such as a mention in the transparency report or hall of fame). We will not take legal action against security researchers who act in good faith and follow this protocol. More details in the Active Response Policy.
Security FAQ
Answers to the most common questions about security on OtakuOshi.
No. Your card is tokenised at the time of payment: the actual number is converted into a token with no value outside the payment system. OtakuOshi never stores or has access to your full card number. Payments are processed through PCI DSS Level 1 certified providers.
A generic, discreet descriptor, with no reference to the OtakuOshi name or the type of content. If you share a bank account with other people, they will not be able to tell what you bought from the statement. More details on the payouts page.
No. Biometric data (facial recognition, document image) is handled exclusively by the third-party verification provider under a confidentiality agreement. OtakuOshi receives only the result (approved/rejected) and the minimum data necessary. We do not store or access the images.
We apply anti-scraping and anti-bot measures, monitor anomalous download patterns, contractually prohibit use for AI training and provide assistance with DMCA takedowns of pirated content on external sites. No platform can eliminate piracy 100%, but we do everything we can to make it harder and to act quickly when it happens.
Change your password immediately and contact hello@otakuoshi.com describing what you have noticed. If you see transactions you do not recognise, contact your bank as well. Our team will review your account activity, close suspicious sessions and help you recover your account.
Never. OtakuOshi will not ask for your password by email, by message or through any other channel. If you receive an email claiming to be from OtakuOshi that asks for your credentials, it is phishing: do not click anything, and forward it to hello@otakuoshi.com so we can investigate.
Write to seguridad@otakuoshi.com describing the vulnerability, the steps to reproduce it and the potential impact. Do not exploit it or disclose it publicly. Acknowledgement within 72 hours, status update within 7 days. We will not take legal action against researchers who act in good faith.
We follow a response protocol: immediate containment, assessment of the scope, notification of affected users and of the data protection authority (72 hours under the GDPR), remediation of the vulnerability and documentation in the transparency report. If your data is affected, we will let you know, along with the steps you can take.
No. OtakuOshi does not use creators’ content to train AI models. In addition, the Terms of Service prohibit third parties from scraping and extracting content for training purposes. We apply technical anti-scraping measures, and the Ethics Policy reinforces this protection.
Questions about your account’s security?
If you spot something suspicious, don’t wait. Contact us and we will act as quickly as possible.