Trust & safety
Security
Last updated: July 18, 2026
Data handling
Workspace content (reel scripts, knowledge base entries, chat history, and production packages) is stored in a dedicated PostgreSQL database hosted by Supabase. Access is enforced by server-side authorization checks before reads/writes. Supabase row-level security policies (migration 20260716120000) also exist as a defense-in-depth layer, and client requests never receive database service credentials.
Encryption
Data in transit is protected with TLS (HTTPS) end to end. Data at rest is encrypted by our infrastructure providers (Supabase, Cloudflare) using industry-standard disk encryption. Passwords are hashed by Supabase Auth and are never stored in plain text.
Authentication & access
Users authenticate via Supabase Auth (email and password). API routes verify the bearer session token on every request, then perform data access with a server-held service-role key. Authorization is enforced in the application layer using organization membership, roles (owner, admin, member), invite tokens, and agent-level permissions to control who can read or write workspace data. Sensitive operations such as organization deletion require elevated roles.
AI & third-party processing
When AI generation is enabled, prompts and retrieved context are sent to Google Gemini over encrypted connections. Do not submit data you are not authorized to share. See our Privacy Policy for subprocessor details and data retention.
Rate limits & abuse prevention
API routes enforce per-user and per-IP rate limits to protect the service from abuse. Typical defaults include hourly caps on AI generation, chat, and knowledge operations, plus daily AI request budgets per user. Public endpoints such as invite preview and invite sign-up are limited per IP. Exceeding a limit returns HTTP 429 until the window resets.
Reporting issues
If you discover a security vulnerability, please report it responsibly to [email protected]. We aim to acknowledge reports within a few business days.