Security at CreatorX AI

All traffic between your browser and CreatorX AI is served over HTTPS with TLS. Data at rest in our managed database and object storage is encrypted by the underlying cloud provider. Passwords are never stored in plain text — they are hashed on our authentication provider.

Sign-in is handled by our managed auth provider. We support email/password with mandatory email verification, plus Google Sign-In. Password reset uses signed, time-limited links.

Sessions use secure, HTTP-only tokens. You can sign out of your account at any time from the Profile page.

Every user-owned table in our database enforces row-level security, so your projects, generations, chat threads, payments and settings are only readable by your account. Server functions that touch privileged data verify the caller's identity before running.

Payments are processed by Razorpay. We never see or store card, UPI or netbanking credentials. Our server verifies every Razorpay signature and webhook before granting a plan or credits, and stores only the order ID, payment ID, amount and status.

Your prompts, uploads and generated outputs are private to your account. We do not use your content to train third-party models where the provider offers a no-training option, and we do not sell your data.

Standard hardening is applied at the edge and in the app:

• HTTPS enforced on all custom domains.
• Security headers: X-Content-Type-Options, X-Frame-Options: SAMEORIGIN, Referrer-Policy, Permissions-Policy, HSTS.
• Server-side input validation with Zod on every server function.
• Webhook endpoints verify HMAC signatures before processing.
• Least-privilege service role — never exposed to the browser.

If you believe you have found a security vulnerability, please email security@creatorxsuite.com with a description, reproduction steps and any proof-of-concept. We ask that you:

• Give us a reasonable window to investigate and fix before public disclosure.
• Do not access, modify or delete data that isn't yours.
• Do not run denial-of-service or spam tests against production.

We aim to acknowledge reports within 3 business days.

If we confirm a security incident that affects your data, we will notify affected users by email with what happened, what data was involved and what we're doing about it, within timelines required by applicable law.

Security is a shared responsibility. Please use a strong, unique password, keep your email account secure, and sign out from shared devices. Report any suspicious activity on your account to support@creatorxsuite.com.

Security issues: security@creatorxsuite.com. Privacy questions: privacy@creatorxsuite.com.