IN SHORT
- Hosting: European Union, Frankfurt. HTTPS only; database over TLS.
- Passwords: scrypt hashes with a per-account salt. Sessions: signed tokens checked on every request.
- Isolation: each customer has their own project and prepaid balance.
- Breach notification within 72 hours, counted from when the infrastructure provider tells us.
Where and how it runs
| Question | Answer |
|---|---|
| Hosting region | European Union — Frankfurt. Platform, database, files and the systems you build. |
| Processing outside the EEA | The AI model processing only, under the European Commission’s standard contractual clauses. |
| Transport encryption | HTTPS only for the site, the platform and what you build. The database is reached over TLS. |
| Database | Managed Postgres, continuous backup, point-in-time restore. Restores are not drill-tested yet. |
| Tenant isolation | Each customer has their own project and their own prepaid balance. |
Accounts and access
- Passwords are stored as scrypt hashes with a per-account salt.
- Sessions are signed tokens, verified on every request.
- The admin panel is behind its own separate login and is not linked from anywhere on the public site.
- Support can open a customer’s studio from the admin panel. We disclose that rather than leaving it to be discovered.
Payments
Card details are entered on Stripe’s own hosted page and never reach our servers. The webhook that credits an account is signature-checked, and the credit transfer is idempotent on the Stripe session id, so a retried webhook cannot credit twice.
Sub-processors
The platform and AI provider behind the studio, Stripe for payments, Google for sign-in when a customer chooses that route, and AWS for the infrastructure. The security page names each and says what it is for.
Retention
| What | Kept for |
|---|---|
| Your systems and their data, while the account is open | As long as you keep them |
| Everything, after the account is closed | 90 days, then deleted |
| Invoices | Ten years, as accounting law requires |
| Vera conversation transcripts | 90 days, then deleted. No audio is ever recorded. |
| Visitor IP addresses | Stored one-way hashed, not in the clear |
Incidents
A breach affecting you is notified within 72 hours, with the clock starting when the infrastructure provider tells us. We say that rather than promising a detection speed we do not control.
The security page carries its own last-updated date; where this summary and that page differ, the security page is right and this one needs fixing.
RELATED
Security — the canonical page, in full
Where your data lives — the residency question on its own
Privacy — what is collected, and on what legal basis