Security

Your designs are your IP. We treat them that way.

Security is part of the architecture, not a feature bolted on. Here is what we do today — stated plainly, without badges we haven't earned.

Your data

Tenant isolation: Every record belongs to an organization. Access is checked on every request, and every database query is scoped to your organization. A request for another organization's data returns “not found” — it doesn't even confirm the thing exists.
Where your data lives: Our servers and database are hosted in Germany by IONOS SE. When you use the AI, your brief and the design context go to our AI provider in the United States — named, with every other processor, on our sub-processors page.
Encryption: TLS in transit everywhere. Credentials we hold for connected services are encrypted at rest with a dedicated key, and are never sent back out through the API.
AI data handling: Prompts and design context go to our AI provider only to produce your result. We do not use your private designs to train models.
Export and deletion: You can export your designs at any time. Account holders can download their personal data and delete their account themselves.

Passwords and sessions: Argon2id password hashing, 15-minute access tokens and rotating refresh tokens with reuse detection. API keys are scoped to one organization, hashed at rest and shown once.
Lockout: Ten failed sign-in attempts lock an account for 15 minutes. Failed attempts and lockouts are recorded and reviewed in our security reports.
Roles: Owner, admin, editor and viewer. Billing and destructive actions need an elevated role.
Staff access: Our internal admin area requires two-factor authentication (TOTP) for every staff account, and is invisible to everyone else.

Tamper-evident audit trail: Sign-ins, two-factor changes, role and plan changes, exports, deletions and every staff action are written to a hash-chained log. Breaking one link breaks the chain, and the chain is verified in every report.
Abuse protection: Per-organization and per-IP rate limits, idempotency keys on writes, and spam defences on public forms. We store IP addresses from forms only as salted hashes.
Browser hardening: A Content-Security-Policy that blocks framing, plugins and scripts from other sites, plus HSTS, a restrictive Permissions-Policy and cross-origin opener policies.
Payments: Payments go through our payment provider's hosted checkout, so card details never touch our servers. Payment webhooks are signature-verified and processed exactly once.
Backups: Integrity-checked database backups, kept for 14 days. We're adding encrypted off-site copies and a recorded restore drill; we'll say so here when they're in place.
Secrets: Secrets live only in locked-down environment files. Production refuses to start with development secrets or without an encryption key.

We have not completed a SOC 2 or ISO 27001 audit, and we won't display a badge until we have. Business customers can sign our Data Processing Addendum and review our sub-processors. Security questionnaires are welcome at m.shafih.akbari@gmail.com.

Responsible disclosure

Email m.shafih.akbari@gmail.com. Our security.txt has the details in machine-readable form.

Give us a reasonable time to fix the issue before telling anyone else — we aim for 90 days or less.
Only test against your own accounts and data. Don't access, change or delete other people's data.
No denial-of-service, spam, social engineering or physical attacks.
Include steps to reproduce, the affected URL or endpoint, and what an attacker could achieve.

We don't run a paid bug bounty at the moment.