Draft — confirm every claim against the real infrastructure before launch.
1API keys
A key is shown once, when you create it. We store only its SHA-256 hash and the last four characters, so a database leak would not expose usable keys. You can create several keys per account, name them, and revoke any of them instantly.
2Memory-only inference
Prompts and outputs are not written to logs, disk or the database. They live in memory for the length of the request and are freed when it ends. The one exception is a finished video, kept encrypted and deleted with its job an hour after it completes.
3Infrastructure
Some models run on GPUs we rent and operate ourselves; others are forwarded to providers whose terms rule out logging prompts. Every key starts in strict mode, which refuses a request rather than send it anywhere else. Before forwarding, we strip user, metadata and safety_identifier, and never pass your IP or headers. Access to production is limited to two named engineers, uses hardware security keys, and every session is recorded in an append-only audit log.
4No request or access logs
We keep no request or access logs and no IP addresses. An error log names no account, key or IP. Rate limits are per account, with proof of work on the onion services; no limit depends on an IP.
5Passwords with OPAQUE
Passwords are registered and checked with the OPAQUE protocol: your password never reaches our servers, and we store neither it nor a hash of it.
6A database off the big clouds
The database runs in Quebec, on hardware we own or rent and run ourselves, not on a hyperscale cloud.
7Deletion
Deleting an account deletes everything about it.
8Onion services
The site and the API are also offered as single-hop .onion services, balanced with Onionbalance. The slip CLI talks to the onion endpoint only, and is open source so you can build and check it yourself.
9Payments
Card, PayPal and Apple Pay payments go through a payment processor, and crypto through Etheroute.io; card details never reach us. Once a payment is validated, we drop its transaction ID. Where a payment method supports it, your bank must verify the payment. More on Anonymity.
10Report a vulnerability
Email security@yourbrand.sh. Please give us 90 days to fix an issue before you publish it. We won't take legal action against good-faith research that stays within your own account, avoids other customers' data, and stops at proof of the problem. We credit reporters who want it.