No internet service can guarantee absolute security. We use layered controls and continuously improve them as the product and risk profile evolve.
Account protection
- Secure, HttpOnly session cookies and request-forgery protection are used for authenticated browser sessions.
- Passwords are handled through the identity system, and supported OAuth providers can be used without sharing the provider password with Supapose.
- Workspace roles and capabilities limit administrative, billing, generation, and asset actions.
Creative assets and isolation
Uploads and generated files are stored in private object storage. The application checks workspace ownership and authorization before returning stable asset URLs or allowing operations. Workspaces separate members, assets, templates, generations, wallet activity, and billing access.
Payment security
Card entry occurs with a secure payment provider. Supapose does not receive or store full card numbers. Purchases are activated only after server-side verification, and idempotency controls reduce accidental duplicate processing.
Operational safeguards
- Security-relevant activity is logged for investigation and reliability monitoring.
- Sensitive configuration is kept outside client code and access is limited to required services and operators.
- Background jobs use controlled state transitions and recovery paths for interrupted generation and payment work.
- Dependencies, deployments, and infrastructure are reviewed and tested as the service evolves.
Service providers
Supapose relies on specialized providers for model execution, storage, authentication, email, and payments. We limit the data sent to what the function requires and evaluate provider access as part of the service’s security design.
What you can do
- Use a unique password, protect connected identity accounts, and sign out of shared devices.
- Grant workspace roles carefully and remove access when it is no longer needed.
- Do not place secrets, passwords, payment credentials, or unnecessary sensitive personal data in prompts or uploads.
- Report unexpected sessions, assets, payments, or generation activity promptly.
Report a vulnerability
Send a clear report to security@supapose.ai with the affected URL or component, reproduction steps, impact, and supporting evidence. Do not access other users’ data, disrupt production, use social engineering, or publicly disclose an unresolved issue. We will acknowledge useful reports and coordinate remediation and disclosure where appropriate.