How CR AudioViz AI protects your data, credentials, and privacy.
All credentials and secrets stored with AES-256-GCM encryption using PBKDF2 key derivation. No plaintext secrets anywhere in the system.
APIs built to OWASP Top 10 standards, with SQL injection prevention, CSRF protection and XSS sanitisation. Rate limiting is enforced on AI generation, code execution and authentication endpoints.
Authentication via Google, GitHub, Discord, Microsoft, and LinkedIn OAuth. No passwords stored unless explicitly set by the user.
Supabase PostgreSQL with RLS policies ensuring users can only access their own data. All queries are scoped to the authenticated user.
Payment data processed exclusively by Stripe and PayPal. We never store raw card numbers. Both providers maintain PCI-DSS Level 1 compliance.
Complete audit trail of credential access, admin actions, and API key usage. Tamper-proof logs stored in Supabase with timestamps.
Every credential is inventoried with an owner and a fingerprint, and rotation is performed against that inventory. Expiry is tracked and flagged before a key lapses.
Honeypot traps and attack-pattern detection at the edge, with automatic IP blocking. Attackers are reported to AbuseIPDB as a verified webmaster, and their community blacklist is pulled back in so known-bad sources are refused before they reach the application.
Every AI call passes a single gateway that screens for prompt injection, scans output for leaked secrets or data, blocks harmful content, and rate limits per account. No application talks to a model directly.
All traffic encrypted in transit. HSTS headers enforced. Certificate management via Vercel's automatic SSL provisioning.
Found a vulnerability? Please disclose responsibly to security@craudiovizai.com. We respond within 24 hours.