How we protect your API keys, your payments and the media you create, and how to report a security problem.
Customer prompts, seed images, audio inputs, and generated video renders are strictly processed for generation delivery. We never use customer data to train, fine-tune, or evaluate foundation AI models.
API tokens (av_live_...) are generated with a cryptographic random generator (128 bits of entropy). Keys are displayed once upon creation and stored exclusively as cryptographic SHA-256 digests in Postgres.
All traffic is HTTPS only (HSTS for two years, including subdomains), behind Cloudflare, with a strict Content Security Policy, no framing by other sites and no MIME sniffing.
Every render holds its allowance in a database transaction before it starts and is counted only when it finishes. A render that fails on our side goes back to your allowance automatically.
We welcome responsible security research. If you discover a potential vulnerability in Avatarity infrastructure, please report it to our security operations group. We answer every valid report and fix confirmed issues as a priority.