Security

Every account’s data is separated at the database level by row-level security, so a query is scoped to its owning account by the database itself rather than by application code remembering to filter. API requests resolve to an account before any data is touched.

• Stored hashed. We cannot show you a key again after it is created — only revoke it.
• Individually revocable, so a leaked key is a one-click problem rather than a password reset.
• Every render is attributable to the key that made it, visible in your usage log.

Completion callbacks are signed with an HMAC secret you fetch from the API, so you can verify a payload genuinely came from us before acting on it. Never trust an unverified callback — ours or anyone’s.

Handled entirely by Stripe. Card details never reach our servers — we hold a customer identifier and your plan, nothing more.

• Per-key and per-account rate limits, with a cap on batch size.
• Request and upload size limits, and validation of uploaded design files before they are decoded.
• Outbound webhook URLs are checked against internal and private address ranges, including after DNS resolution, so a webhook cannot be pointed at infrastructure.

An automated reconciliation compares payments taken in Stripe against credits granted in our ledger, and alerts on any mismatch — including a grant of the wrong size, not only a missing one. It reads from Stripe rather than from our own records, so a failure on our side cannot hide itself.

We do not hold SOC 2 or ISO 27001, and we have not commissioned a third-party penetration test. We would rather say so than imply otherwise — if either becomes a requirement for you, tell us and we will talk about timelines honestly.

Email security@anjin.design. Tell us what you found and how to reproduce it. We will acknowledge within two working days, we will not take legal action against good-faith research, and we will credit you if you would like us to.