Security
How we protect the service, and how to report a vulnerability.
Overview
We take reasonable technical and organisational measures to protect the information we hold, and we say plainly where the limits are. No system is completely secure. This page lists what we do, what we ask of you, and how to tell us about a problem.
What we do
- All data in transit is encrypted over HTTPS.
- Card and cryptocurrency details are handled by Stripe and NOWPayments. We never store them. See Subprocessors.
- An API key is shown once, when it is issued. We cannot recover it later, only issue a new one.
- Free keys need a verification code sent to a supported personal email address. The code works once and expires after 15 minutes.
- Cloudflare Turnstile and per-key rate limits protect the service from automated abuse.
- Media files and audio you send for processing sit in temporary storage only while the job runs, then are deleted. The Privacy Policy lists the details for each tool.
What we ask of you
Your API key is a secret. If it is exposed, for example by committing it to a public repository or sharing it in a forum, requests made with it are your responsibility and consumed credits are not restored. Use a browser-safe key for code that runs in a browser, and keep paid keys on your server. Details are in Privacy Policy section 5 and the Terms.
Reporting a vulnerability
Send reports to [email protected]
Use the subject "Security" and include enough detail for us to reproduce the issue.
A useful report has:
- The affected address or feature (for example a URL or an API route).
- Steps to reproduce, and what you expected to happen.
- What an attacker could do with it.
We ask that you:
- Test only against your own account and keys.
- Do not read, change or delete other people's data, and do not degrade the service for others.
- Give us reasonable time to fix the issue before you share it publicly.
Denial-of-service testing, social engineering of our staff or users, and issues in third-party services (report those to the provider) are out of scope. We do not currently run a paid bug bounty.
If something goes wrong
If a data breach is reasonably likely to harm you, we will tell affected users without unreasonable delay, by email to the address on your account, in line with applicable US state breach notification laws. What the notice contains is set out in Privacy Policy section 11.
Contact
[email protected] or the contact page.