Security

All traffic is served over HTTPS/TLS. The application runs on Vercel; the database is PostgreSQL on Neon (serverless, EU region — eu-central-1); files (voiceovers, videos, uploaded logos) are stored on Vercel Blob. No customer data is stored outside these providers.

Passwords are hashed with bcrypt and never stored or logged in plain text. Optional two-factor authentication (TOTP, with one-time backup codes) is available for credentials accounts. Sign-in is capped per IP address and locks an account after repeated failed attempts; sign-up is rate-limited per IP. Email addresses are masked in application logs.

API keys, password-reset tokens and email-verification tokens are stored only as SHA-256 hashes — never in a form that can be read back, even by us. Uploaded SVG logos (white-label branding) are sanitized before use to remove embedded scripts. Deleting your account removes your projects, generated content and files; a self-service data export (Settings → Export your data) covers GDPR data portability.

Every response carries security headers: a restrictive Content-Security-Policy, X-Frame-Options (clickjacking protection), nosniff, a strict Referrer-Policy and a Permissions-Policy that disables camera/microphone/geolocation/payment access by default. Every API route requires authentication except sign-up, the auth callback and the Stripe webhook (which verifies its signature instead).

Errors are captured in production via Sentry (EU region). Agency accounts get a full audit log of team, API-key and branding changes, visible in Settings.

We publish a Data Processing Agreement (DPA) alongside our Privacy Policy. You can export or delete your data at any time from Settings. Note: our published entity is a non-EU company that has not yet appointed a formal Article 27 GDPR representative for EU data subjects — a known, disclosed gap we're addressing, not something we've tried to paper over.

Found a security issue? Email hello@sniplyx.com with details — we read every message and will respond directly. Please don't test against other users' accounts or data; use your own test account.