Security Practices

Last updated: August 24, 2026

Pour Toi uses layered technical and operational controls to protect accounts, sessions, and user data.

1. Account and Session Security

• Device-bound sessions with token refresh controls and revocation support.
• Server-side fraud and risk checks on sensitive auth and account actions.
• Rate limits on login, password reset, nearby scanning, and messaging write operations.

2. Identity and Abuse Prevention

• Camera-based avatar verification and anti-duplicate checks before core feature unlocks.
• Automated and manual moderation support for harmful behavior reports.
• Safety actions in-app: block, report, and conversation-level controls.

3. Transport and Platform Security

• HTTPS in production with strict transport headers.
• Content Security Policy and permissions policy applied on web responses.
• Security headers to reduce common browser attack surface.

4. Data Handling and Access

• Least-privilege access approach for production operations.
• Audit-friendly consent and policy records for NEARBY and privacy features.
• User controls for account deletion and data-related requests.

5. Realtime and Audio Calling

• Call signaling runs over authenticated, encrypted connections tied to your account session.
• Only the two participants in a one-on-one conversation can call each other; a call cannot be initiated by or connected to anyone else.
• Audio is transmitted using WebRTC. Where a direct connection is not possible, our TURN relay server facilitates the connection using short-lived, call-specific credentials.
• Blocking a member ends any active call between you and immediately prevents further calls.

6. Security Contact

Report security concerns: security@pourtoi.love