Security summary
Vantloop · Last reviewed 2026-11-09 · This page describes the controls in the platform's code. Vantloop holds no third-party security audit, and this page claims none — it is the honest version: what the code does, stated so it can be checked.
Credentials
Passwords are hashed with PBKDF2 — SHA-256, 100,000 rounds, a per-user random salt — using the WebCrypto API. The platform never stores a password in plain text, and password hashes are never returned by any API. Accounts created through Google sign-in hold no Vantloop password at all.
Codes and tokens
Sign-in codes, email-verification links, password-reset links and withdrawal confirmation codes are stored only as SHA-256 hashes. Codes expire after 10 minutes, work once, and are burned after five failed attempts; code requests are rate-limited, and a fresh request replaces the previous code. Withdrawals require a fresh code on top of the signed-in session.
Sessions
A session is an opaque 256-bit random token; only its SHA-256 hash is stored. The cookie is HttpOnly, marked Secure on HTTPS, and set for 30 days — or one day when "remember me" is left off at sign-in. Signing in rotates the session token, and a password reset revokes every existing session on the account.
Identity documents
ID photos and selfies are stored in the platform database and served through exactly one route, which requires the platform owner's admin account and answers with Cache-Control: no-store. No public URL reaches a document. A rejected verification deletes the documents; the decision and its note stay on the record.
Money
Payments are recorded in the platform ledger: funded amounts are held against a job, released only by the client's recorded action after delivery (or, on hourly jobs, by approval of a timesheet week against money already funded), and every payment shows its gross, the platform fee, and the net. Vantloop never takes or stores card numbers. A talent's payout bank and account number live only in their application record — they are never emailed, and every surface displays the bank name plus the last four digits only. Withdrawal decisions are recorded in the admin queue with the decider and the decision.
Account email — verification, resets, codes, job and payment notices — is sent through Resend when its key is connected; until then it is held in the platform's own database outbox rather than passing through any other service. The current state of that connection is published on Platform status.
Administration
The admin queues — identity review, assessment grading, withdrawals, shortlists — open only to the platform owner's account. Decisions there are recorded on the item itself, with the decider and the time.
Reporting a vulnerability
Write to hello@victorantai.com with what you found and how to reproduce it. Every report is read. If you are testing, please do not access or alter another member's data — a description of the path is enough.