Legal

Security

How studios are isolated from one another, how data is encrypted, and how to report a vulnerability.

1. 01

   Isolation

   Every workspace runs on its own database with its own credentials. Within a workspace, access is enforced by Postgres row-level security rather than by application code — a factory account is restricted at the database, so a mistake in a page cannot widen what it can read.

2. 02

   Encryption in transit and at rest

   All traffic is HTTPS. Data at rest is encrypted by Supabase, and uploaded photographs and generated imagery sit in access-controlled object storage.

3. 03

   Access control

   Studio accounts see the whole workspace. Factory accounts are scoped to the styles assigned to them and cannot see costings or margin at all. Public share links carry a 48-character random token and expose one document each.

4. 04

   Backups and recovery

   Point-in-time recovery is provided by the database host. We hold no separate copy of your data outside it.

5. 05

   Sub-processors

   Supabase for database, authentication and storage. Vercel for hosting and for the AI Gateway. Model providers reached through that gateway — Anthropic for drafting text, Google for image generation. We will tell you before that list changes.

6. 06

   Reporting a vulnerability

   security@samplesignal.com. Tell us what you found and how to reproduce it. We will confirm receipt, fix it, and credit you if you want the credit. We will not threaten you for looking.