Security
Protection for accounts, connections, and creator media.
Argmax uses server-managed sessions, encrypted platform credentials, tenant access controls, request protections, and temporary-media cleanup as part of its private-beta security model.
Sessions and requests
Session cookies are configured as HttpOnly, Secure, SameSite=Lax, and scoped to the application. State-changing requests require an allowed origin and a CSRF token.
Connected-platform credentials
OAuth token material is encrypted with AES-256-GCM. A separate random data key is used for each connection payload, and the wrapping keys support rotation.
Tenant data access
Product records carry an account identifier. Database row-level security policies limit authenticated access to memberships and active product data for the relevant accounts.
Media and account removal
Worker scratch directories are removed after terminal or retrying attempts, and temporary object storage expires after one day. The privacy policy describes retention and account rights.