Security & Data Protection

Encryption

• All data transmitted to and from our servers is encrypted using TLS 1.3
• Sensitive data is encrypted at rest using AES-256 encryption
• Database connections use encrypted channels
• API communications with third-party services are encrypted

Access Controls

• Multi-factor authentication for administrative access
• Role-based access control (RBAC) for team members
• Regular access reviews and principle of least privilege
• Secure password policies and account lockout mechanisms

Infrastructure Security

• Hosted on secure, SOC 2 compliant cloud infrastructure
• Regular security updates and patch management
• Network segmentation and firewall protection
• Intrusion detection and monitoring systems

Data Minimization

We collect only the data necessary to provide our services:

• Account information (email, encrypted password)
• Usage data for service improvement
• Generated content based on your subscription plan retention policy

Data Processing

• Your prompts and images are processed only to provide AI services
• We do not use your content to train our own AI models
• Third-party AI providers process data according to their privacy policies
• No human review of your content except for abuse prevention

Data Retention

• Generated content automatically deleted per subscription plan limits
• Account data retained until account deletion
• Logs and analytics data retained for 90 days maximum
• Backup data securely deleted after retention periods

AI Service Providers

All AI service providers are required to meet strict security and compliance standards, including SOC 2 certification and GDPR compliance where applicable.

Payment Security

• Creem payment processor is PCI DSS compliant
• We do not store credit card information
• All payment data is encrypted and tokenized
• Fraud detection and prevention measures in place

Automated Safety Measures

• AI-powered content filtering to prevent harmful outputs
• Prompt analysis to detect prohibited content requests
• Real-time blocking of NSFW and violent content
• Automated detection of potential copyright violations

Human Review

• Flagged content reviewed by trained moderators
• Appeals process for incorrectly flagged content
• Regular audits of moderation accuracy
• Continuous improvement of detection systems

User Reporting

• Easy reporting mechanism for inappropriate content
• 24-hour response time for safety reports
• Transparent communication about actions taken

24/7 Monitoring

• Real-time security monitoring and alerting
• Automated threat detection and response
• Performance and availability monitoring
• Regular security scans and vulnerability assessments

Incident Response Plan

• Defined procedures for security incidents
• Rapid response team available 24/7
• Communication plan for affected users
• Post-incident analysis and improvement process

Business Continuity

• Regular data backups across multiple regions
• Disaster recovery procedures tested quarterly
• Redundant systems and failover capabilities
• 99.8% uptime SLA with monitoring and alerts

Data Protection Regulations

• GDPR compliance for European users
• CCPA compliance for California residents
• Data processing agreements with all vendors
• Regular compliance audits and assessments

Industry Standards

• Following OWASP security guidelines
• Implementing NIST Cybersecurity Framework
• Regular penetration testing by third parties
• Security awareness training for all staff

Account Security

• Use a strong, unique password for your account
• Enable two-factor authentication when available
• Log out from shared or public computers
• Regularly review your account activity

Content Guidelines

• Don't upload sensitive personal information
• Ensure you have rights to any images you upload
• Be cautious when sharing generated content publicly
• Report any security concerns immediately

Report Security Issues

If you discover a security vulnerability or have security concerns, please contact us immediately:

Responsible Disclosure

We appreciate responsible disclosure of security vulnerabilities. We commit to:

• Acknowledging your report within 72 hours
• Providing regular updates on our investigation
• Crediting researchers who help improve our security
• Not pursuing legal action for good-faith security research

General Support