Security

Payments

Card details never touch our servers. Payment is handled by Stripe, a PCI-DSS Level 1 provider; we store a payment reference and an amount. There is no card data in our database to lose.

The price is set on our side

The amount charged is always computed on the server from the studio's saved markup and the configuration. A price supplied by a browser is never trusted, anywhere in the flow. This is a deliberate design rule, not a filter — there is no code path where a number from a client becomes an amount charged.

Accounts and keys

• Passwords are hashed; we cannot read them.
• Admin sessions are signed, expiring tokens compared in constant time. The master secret signs them and never leaves the server.
• Each studio gets its own API key, scoped to that studio and revocable. A studio can only ever report its own orders.
• New accounts land pending and cannot trade until a human approves them.

Data separation

Access rules are enforced at the data layer, not just in the interface: a studio reads only its own record, a partner reads only commissions crediting them, and margin data is returned only to the account it belongs to. Row-level security is on for the business tables.

Abuse controls

Sign-in, registration and the AI endpoints are rate-limited per IP against a shared store, so limits hold across server instances rather than being multiplied by them. Sign-up forms carry silent bot traps.

Infrastructure

Hosted on Vercel with a managed Postgres database at Supabase. Everything is served over TLS; data is encrypted at rest by the provider; backups are managed and point-in-time recovery is available. Secrets live in the platform's encrypted environment store, never in the repository.

What we don't claim

We are not SOC 2 or ISO 27001 certified, and we would rather say so than imply otherwise. We are a small team; the controls above are the ones we operate and can evidence. If you need a formal audit position before deploying our widget, talk to us and we will tell you honestly where we stand.

Reporting a vulnerability

Email hello@aiframing.com with "security" in the subject. We will acknowledge within two business days. Please give us a reasonable window to fix an issue before disclosing it — we will not pursue anyone who reports in good faith and doesn't destroy data or access other people's information.