How we protect your agency

Security

Espeon holds access to model accounts and your agency's money Here is exactly what protects them

Sign-in and sessions

Passwords are stored only as Argon2id hashes.
Two-factor authentication with an authenticator app.
Short-lived access tokens; any session can be ended and stops working immediately.
Rate limits on sign-in and other sensitive requests.

Agency isolation and permissions

The agency is taken from the server-side session, so other agencies' data is unreachable even with a forged request.
Every action is checked against the role's permissions on the server; a hidden button is not security and we never rely on it.
An activity log of who changed what and when.

Browser and model accounts

Every account opens in its own Chromium profile with separate cookies and proxy.
Platform websites run without access to Node.js or your system (contextIsolation, no nodeIntegration).
Operators never see the account password or proxy address; proxy passwords are stored encrypted.

Chats

Message Guard checks a message before sending and blocks contacts, links, messengers and payment details.
Evasion tricks are handled: separators, look-alike characters, invisible characters.

App builds

Every build comes with a published SHA-256 checksum. Verify it before installing.

Found a vulnerability?

Tell us and we will respond and fix it Please don't publish details before the fix