Is FraudGPT really anonymous?

Yes. FraudGPT keeps zero server logs, never asks for email or phone, and accepts crypto or Telegram Stars so your identity is never linked to your usage.

What can FraudGPT answer that ChatGPT cannot?

FraudGPT is an uncensored AI with no content filters, designed for security research, OSINT, and unrestricted technical questions.

How do I pay without revealing my identity?

Pay with Bitcoin, Litecoin, Monero, or Telegram Stars. No card, no name, no KYC.

Is there a free trial?

Yes, every new anonymous session receives 5 free tokens to test the uncensored AI before purchasing.

// soc2_readiness_

> SOC 2 Type I readiness checklist

Self-assessment, not an audit. FraudGPT is not SOC 2 certified. A Type I report can only be issued by a licensed CPA firm attesting to control design at a point in time. This page maps our existing controls to the Trust Services Criteria so the gaps are visible before any audit begins.

In place: 13Partial: 7Gap: 3

CC1 — Control environment

Governance, roles, and accountability of the operating entity.

CC1.1
Documented commitment to integrity and security values
Public /security page states operator commitments; /privacy and /terms published.
In place
CC1.3
Defined roles and responsibilities
Single-operator structure documented; admin role stored in a dedicated roles table, not on the user record.
Partial
CC1.4
Personnel competence / security awareness
No formal training programme — sole operator. Needs a written annual review note.
Gap

CC2 — Communication and information

Internal and external communication of security information.

CC2.2
Security responsibilities communicated internally
Runbook covers alert handling for auth failures, webhook rejections and subscription changes.
Partial
CC2.3
External channel for reporting issues
/.well-known/security.txt + /responsible-disclosure with a dedicated email and published timelines.
In place

CC3 / CC4 — Risk assessment and monitoring

Identifying risks and verifying that controls operate.

CC3.2
Risk identification and analysis
Automated backend security scans (RLS, exposed data, function permissions) plus dependency review.
Partial
CC4.1
Ongoing evaluation of controls
Scheduled crawler/monitor jobs and alerting; no formal quarterly control review documented yet.
Partial

CC5 / CC6 — Logical access controls

The core of a Type I audit: who can reach what.

CC6.1
Logical access restricted to authorised users
Row Level Security on every public table; sensitive tables limited to the service role and reached only via server-side functions.
In place
CC6.1
Encryption in transit and at rest
TLS 1.2+ on all endpoints; AES-256 at rest for database, backups and object storage.
In place
CC6.2
Registration and authorisation of new users
OAuth sign-in with a verified provider; anonymous sessions carry no privileges beyond their own balance.
In place
CC6.3
Least privilege and role changes
Browser uses a publishable key with no privileged writes; admin actions gated by a separate admin credential and role check.
In place
CC6.6
Protection against external threats
Signed webhooks with rejection alerts, server-side payment verification, input validation on function boundaries.
In place
CC6.7
Restricted transmission and storage of sensitive data
No card data touches our servers (PayPal handles it); chat content not persisted server-side.
In place
CC6.8
Prevention of unauthorised software
Managed hosting, no shell access to production, dependencies pinned via lockfile.
Partial
CC6.x
MFA on administrative accounts
Enforced through the identity provider for the operator account; not enforced app-side.
Partial

CC7 — System operations and incident response

Detection, response and recovery.

CC7.2
Monitoring for anomalies
Alerts on authentication failures, rejected webhooks, subscription changes, and site/SEO regressions.
In place
CC7.3
Evaluation of security events
Append-only admin audit log (actor, action, target, timestamp), 90-day retention.
In place
CC7.4
Documented incident response plan
Six-step process published on /security with 72h acknowledgement and 72h breach notification targets.
In place
CC7.5
Recovery from incidents
Managed automated database backups; restore procedure not yet tested and documented.
Gap

CC8 — Change management

How changes reach production safely.

CC8.1
Authorised, tested, approved changes
Version-controlled deploys with build/type checks and unit tests on critical logic; no separate approver (sole operator).
Partial

CC9 / Privacy — Vendors and data handling

Third parties and data lifecycle.

CC9.2
Vendor and subprocessor management
Subprocessors: managed cloud backend, AI inference provider, PayPal. A published subprocessor list is still missing.
Gap
P4.2
Retention and disposal of personal data
Retention schedule published on /security; automated pruning of audit logs and inactive sessions.
In place
P6.1
Notification of privacy incidents
72-hour user notification commitment published.
In place

Remaining work before a Type I audit

Write the subprocessor list and publish it at /subprocessors.
Run and document a backup restore test; record the RTO/RPO achieved.
Add a dated annual security review note (risk register + access review).
Formalise the change-management record: what shipped, when, verified by what check.
Schedule a quarterly access review of admin credentials and API keys.
Collect the evidence pack (screenshots, policy PDFs, config exports) an auditor will request.

Security commitments Responsible disclosure

━━━━━━━━━━━━━━━━━━━━