How BentBox Protects Your Account, Your Content and Your Payments
The security decisions that matter most at BentBox are the ones about what we refuse to hold.
BentBox protects buyers and creators primarily through data minimisation: card details are held by licensed payment processors and never by BentBox, identity documents and biometrics are held by ProntoID — a legally separate company and independent data controller — and content authorization is recorded as cryptographic fingerprints rather than copies of the media itself. What remains on BentBox infrastructure is account data, listings and audit metadata, encrypted in transit and at rest on AWS, with purchased media held in private storage that is released only to the buyer who paid for it, and every listing reviewed by a human moderator.
We never hold your card
Card details are captured and stored by our payment processors, never by BentBox. Our database holds a transaction reference and a status — nothing that could be used to charge you.
We never hold your ID
Identity and age verification is carried out by ProntoID, a separate company and a separate data controller. BentBox receives a pass or fail result — never the document, never the selfie.
Authorization without exposure
PrestoMint records a cryptographic fingerprint of authorized content rather than the content itself. Authorization can be proven without any third party ever holding your images.
Humans review listings
Every listing passes through human moderation. We do not rely on automated classification alone to decide what belongs on the marketplace.
The principle: the safest data is the data we never collect
Most platform security writing is a list of the defences a company has built around the sensitive data it holds. That framing accepts the premise that the company should hold the data in the first place. BentBox starts one step earlier. Every category of information that would be genuinely damaging in a breach — payment credentials, government identity documents, biometric templates — has been deliberately pushed outside the BentBox perimeter, into the hands of specialist parties who exist to hold it, under separate legal entities.
This is not a rhetorical position. It is an architectural one, and it has real costs: it makes integration harder, it means more moving parts, and it means BentBox cannot answer certain questions about you because BentBox genuinely does not know the answers. We consider that a feature. A marketplace that has been operating since 2015 in a category that attracts hostile attention should be structured so that a worst-case compromise of its own systems still does not expose a creator’s passport or a buyer’s card.
1. Payments — BentBox never sees your card
Card data on BentBox is captured and stored by our payment processors, Verotel and EMerchantPay. These are licensed, PCI DSS compliant processors whose entire business is handling card data safely. The payment step happens on infrastructure they control. BentBox receives back a transaction reference and an approved or declined status — enough to unlock the purchase, and nothing that could be used to charge a card again.
The practical consequence is worth stating plainly: there is no table in the BentBox database containing card numbers, because there is nothing to put in it. An attacker with full read access to BentBox storage would find purchase records and processor references, not payment credentials.
On the creator side
Creator payouts run monthly by bank transfer, Paxum, Yoursafe, PayPal or gift card. Payout details are stored separately from general account data, are accessible only to the small number of staff who process payouts, and are never exposed through the public site or the creator dashboard beyond a masked reference. Changes to payout destinations trigger a notification to the account owner, so a silent redirection of earnings is not possible without you hearing about it.
A note on pricing transparency, because it is a security issue too. Creators keep 100% of their listed price. The BentBox commission is added on top of that price and paid by the buyer — a minimum of $3 for items under 100MB and $5 at 100MB and above. Hidden deductions are how creators end up unable to reconcile their own earnings, and an account whose owner cannot reconcile it is an account where fraud goes unnoticed.
2. Identity and age verification — handled by a separate company
Age and identity verification on BentBox is performed by ProntoID. ProntoID is operated by Brooks & Keitt Sàrl in Sion, Switzerland. BentBox is operated by Haas & Reed B.V. in Utrecht, Netherlands. These are two separate companies, and under the GDPR they are two independent data controllers — not a controller and its processor.
When you verify, your identity document and any liveness or selfie capture go to ProntoID. They are assessed there. BentBox receives the outcome — verified or not verified — together with audit metadata such as when the check occurred and which method was used. BentBox does not receive the document image. BentBox does not receive a biometric template. BentBox has no mechanism to request them.
- Your username, email and account settings
- Your listings, sales and purchase history
- Messages sent through BentBox Messenger
- A verification outcome: yes or no
- Audit metadata: when, and by what method
- Passport, ID card or driving licence images
- Biometric or facial recognition templates
- Full card numbers or bank credentials
- Your account password in readable form
- Liveness capture video or stills
Age gating for visitors
Separately from creator verification, BentBox enforces an age assurance gate for visitors in jurisdictions that require one — currently 25 US states plus the United Kingdom, France, Germany, Italy, Spain, Australia and Brazil. Users who have already completed identity verification are not asked again. Where a jurisdiction requires re-verification at intervals, that requirement is honoured through ProntoID rather than by BentBox retaining anything additional.
3. Consent and documentation
Every person depicted in content sold on BentBox must be an adult who has consented to that content being published and sold. Creators are required to hold documentation supporting this, and BentBox accepts conventional signed model releases as it always has.
ProntoTag is an optional enhancement rather than a replacement. It produces a cryptographically signed consent record that binds the consent to a ProntoID-verified identity — not to a BentBox username, which anyone can create. The distinction matters when a release is challenged years later: a paper release proves that someone signed a document, while a ProntoTag record proves that a verified individual consented at a specific time to specific terms, and that the record has not been altered since. ProntoTag costs €0.99 per tag and is entirely the creator’s choice.
4. Content authorization — proving it without exposing it
PrestoMint is a content-blind authorization ledger. When content is authorized, what gets written to the ledger is a cryptographic fingerprint of the file — a hash — not the file. The fingerprint is a one-way derivation: it can confirm that a specific file matches an authorization record, but it cannot be reversed to reconstruct the image or video.
This solves a problem that otherwise has no good answer. Proving that a piece of content was authorized normally requires someone to hold a copy of that content for comparison, which means creating another repository of sensitive material and another thing to breach. A fingerprint ledger gives the same evidentiary value with none of the exposure. Photographers, models and platform moderators can all verify against the same record without any of them needing to hand the media to a third party.
5. Human moderation
BentBox is a curated marketplace, not an open upload host. Listings pass through human review before they go live. Automated tooling assists with triage and flags likely problems, but the decision about whether something belongs on the marketplace is made by a person.
This is slower and more expensive than classifier-only moderation, and it is the correct trade-off. Automated systems fail in both directions: they wrongly remove legitimate artistic, glamour and boudoir work that sits comfortably within legal standards, and they miss genuinely harmful material that has been packaged to evade them. Neither failure mode is acceptable for a marketplace whose creators depend on it for income and whose obligations around content legality are absolute.
6. Infrastructure and access control
BentBox runs on Amazon Web Services. The practical security properties that follow from that:
Passwords and sessions
Account passwords are stored as one-way hashes. Nobody at BentBox can read your password, which is also why nobody at BentBox will ever ask you for it. Any message requesting your BentBox password — by email, by direct message, by anything — is a phishing attempt regardless of how convincing the sender looks. Report it and delete it.
7. Your data rights, and who to ask
Because BentBox and ProntoID are independent data controllers, data subject requests must be directed to the right company. BentBox can answer for your account, your listings, your purchases, your messages and the audit metadata attached to your verification status. ProntoID must answer for the identity document and biometric data used to perform verification — BentBox cannot retrieve, export or delete that material on your behalf, because BentBox does not have it.
This split occasionally frustrates people who would prefer one address for everything. It is a direct consequence of the architecture that keeps your passport out of a content marketplace’s database, and we think that is the right trade. Full detail on what is collected, why, and for how long it is retained sits in the Privacy Policy and the Legal Center.
8. What we ask of you
Platform architecture handles a great deal, but account compromise overwhelmingly begins with the account holder rather than the platform. Four things carry most of the weight:
- Use a unique password. Password reuse is the single most common route into any account. A password manager removes the difficulty entirely.
- Secure the email address on your account. Whoever controls your email controls password resets, which makes your inbox the real perimeter.
- Treat urgency as a warning sign. Genuine BentBox communication does not pressure you to act within minutes, does not ask for your password, and does not ask you to move a conversation off-platform to complete a sale.
- Verify payout changes. If you receive notice of a payout detail change you did not make, contact support immediately rather than waiting for the next cycle.
9. Reporting a vulnerability
If you have found a security issue, email security@bentbox.co with a description and reproduction steps. We ask that you report privately first and allow a reasonable window for a fix before any public disclosure.
While testing, please do not access, modify, download or retain data belonging to other users, do not run automated scanning that degrades service for others, and do not attempt social engineering against BentBox staff or creators. A proof of concept that demonstrates the flaw is sufficient — there is no need to prove impact by exploiting it.
Frequently asked questions
Security you can check rather than take on faith
Every claim on this page describes an architectural decision, not an aspiration. If something here does not match your experience of the platform, we want to hear about it.
Contact BentBoxRelated reading
- The BentBox Legal Center — terms, policies and compliance documentation in one place.
- Privacy Policy — what is collected, why, and how long it is kept.
- A GDPR guide for photographers — your own obligations when you shoot and sell.
- All BentBox guides and field notes