Security Architecture

Trust & Safety

Every layer of GUINEX is engineered for trust. From atomic wallet transactions to admin-reviewed uploads, here's how we protect you.

Trust Architecture Overview

72-Hour Escrow

Every unlock triggers a 72-hour hold on creator earnings. Funds release only after the protection window closes without disputes.

Atomic Transactions

All GP operations use Firestore runTransaction() — balance checks, deductions, and credits happen atomically, preventing double-spending.

Admin Review

Every project upload goes through admin approval. Every user review is moderated. No content goes live without human review.

RBAC Security

Role-based access control (User/Moderator/Admin/SuperAdmin) enforced both client-side and server-side via Firestore security rules.

HTTPS & Headers

All traffic encrypted with TLS. Security headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

Private Chat

Support Chat is end-to-end isolated per order. Only the buyer, creator, and investigating admin can access chat history.

Payment & Wallet Security

  • Firestore Client Transactions: Every wallet operation (recharge credit, unlock deduction, earning split, withdrawal) uses runTransaction() for atomicity. If any concurrent modification occurs, the transaction automatically rolls back and retries.
  • Server-Side Validation: Firestore security rules independently validate all wallet field modifications. Client code alone cannot write arbitrary values to wallet balances — the server rejects invalid modifications.
  • UTR Verification: Recharge payments are verified by admin against actual bank deposits. Each UTR can only be used once — duplicate UTRs are flagged and rejected.
  • Withdrawal Validation: Withdrawal amounts are validated against Available Balance minus pending withdrawal requests. Over-withdrawal is impossible due to atomic transaction checks.
  • No Credential Storage: GUINEX never stores UPI PINs, banking passwords, or payment app credentials. Passwords are hashed by Firebase Authentication.

Content Moderation System

GUINEX uses a multi-layer moderation system to ensure content quality and safety:

Upload Review

Every project upload enters "Pending" status. Admin reviews content, description accuracy, code quality, and checks for prohibited material before approval.

Review Moderation

All user reviews go through admin moderation before appearing publicly. This prevents fake reviews, spam, and abusive content.

Edit Re-Review

Editing a live (approved) project returns it to "Pending" status for re-review. This prevents unauthorized changes after initial approval.

Community Reporting

Users can report projects, users, and copyright violations. All reports are investigated by admin within 24-48 hours.

Fraud Prevention

  • Double-Spend Prevention: Atomic Firestore transactions ensure a GP balance can't be spent twice simultaneously.
  • UTR Deduplication: Each payment UTR can only be used for one recharge request, preventing duplicate claims.
  • Duplicate Unlock Prevention: The system checks if a user has already unlocked a project before processing — you can't be charged twice for the same project.
  • Bad-Faith Dispute Detection: Admins review dispute patterns. Users who file fraudulent disputes repeatedly face account restrictions.
  • Multi-Account Detection: Creating multiple accounts to circumvent bans or manipulate the platform violates Terms and results in all related accounts being terminated.

Community Trust Mechanisms

Verified Reviews

Only users who have actually unlocked a project can leave reviews. All reviews are admin-moderated before publication.

Transparent Badges

Three badge tiers (Community Published → GUINEX Reviewed → GUINEX Certified) clearly communicate verification level.

Public Profiles

Creator profiles show real follower counts, project history, ratings, and college information — building accountability.

Direct Communication

Support Chat connects every buyer directly to the creator, creating personal accountability and faster issue resolution.

Questions About Security?

If you have concerns about platform security, data protection, or need to report a vulnerability, contact our team.

Contact Security Team