At Moire, security is foundational to everything we build. We understand that you trust us with your creative work and personal information. This page outlines how we protect your data.
1. Infrastructure Security
1.1 Hosting and Network
- Platform: Hosted on Vercel's enterprise-grade infrastructure with automatic DDoS protection
- CDN: Global edge network for fast, secure content delivery
- TLS Encryption: All traffic encrypted with TLS 1.3
- DNS Security: DNSSEC enabled for DNS integrity
1.2 Database Security
- Encryption at rest: All data encrypted using AES-256
- Encryption in transit: SSL/TLS for all database connections
- Access control: Role-based access with principle of least privilege
- Backups: Daily automated backups with point-in-time recovery
- Isolation: Dedicated database instances per environment
2. Application Security
2.1 Authentication
- Identity Provider: Clerk - enterprise-grade authentication
- Multi-factor authentication: Available for all accounts
- Session management: Secure, httpOnly cookies with short expiration
- OAuth 2.0: Social login via Google, GitHub with secure token handling
- Password security: Bcrypt hashing, breach detection, strength requirements
2.2 API Security
- CSRF Protection: Token-based protection on all state-changing requests
- Rate Limiting: Request throttling to prevent abuse
- Input Validation: Strict schema validation on all inputs
- Output Encoding: XSS prevention through proper encoding
- CORS: Strict cross-origin policies
2.3 Code Security
- Dependency Scanning: Automated vulnerability scanning for dependencies
- Static Analysis: Code quality and security linting
- Secret Management: Environment variables, never hardcoded secrets
- Code Review: All changes reviewed before deployment
3. Payment Security
3.1 PCI DSS Compliance
We use Stripe for all payment processing. Stripe is a certified PCI Level 1 Service Provider, the most stringent level of certification available.
- We never store: Full credit card numbers, CVV codes, or sensitive authentication data
- Stripe handles: All payment card processing, tokenization, and storage
- Fraud detection: Stripe Radar for real-time fraud prevention
3.2 Billing Security
- Card details never touch our servers (Stripe.js tokenization)
- Subscription management through Stripe Customer Portal
- Secure webhooks with signature verification
4. Data Protection
4.1 Your Generated Content
- Access control: Only you can access your generations (unless shared)
- Secure storage: Images stored in encrypted cloud storage
- Signed URLs: Time-limited access tokens for image retrieval
- Deletion: Permanent removal available on request
4.2 Prompt Privacy
- Prompts are processed securely and associated only with your account
- We do not share individual prompts with third parties
- AI processing occurs through secure API connections
5. Third-Party Security
We carefully vet all third-party services we use:
| Service | Purpose | Compliance |
|---|---|---|
| Clerk | Authentication | SOC 2 Type II, GDPR |
| Stripe | Payments | PCI DSS Level 1, SOC 2 |
| Vercel | Hosting | SOC 2 Type II, GDPR |
| Google Cloud | AI Services | SOC 1/2/3, ISO 27001 |
| PostHog | Analytics | SOC 2 Type II, GDPR |
6. Compliance
6.1 Current Compliance
- GDPR: Full compliance for EU users
- CCPA/CPRA: Full compliance for California residents
- PCI DSS: Compliant via Stripe (no card data stored)
6.2 Roadmap
- SOC 2 Type II: [TIMELINE]
- ISO 27001: Under evaluation
7. Incident Response
7.1 Our Commitment
In the event of a security incident:
- Detection: 24/7 monitoring and alerting systems
- Response: Immediate investigation and containment
- Notification: Affected users notified within [72] hours as required by law
- Remediation: Root cause analysis and preventive measures
7.2 Breach Notification
If a breach affects your personal data, we will notify you via:
- Email to your registered address
- In-app notification
- Public disclosure if legally required
8. Vulnerability Disclosure
8.1 Responsible Disclosure
We welcome responsible security research. If you discover a vulnerability:
- Email: [SECURITY_EMAIL]
- Include detailed steps to reproduce
- Allow us reasonable time to address the issue
- Do not access or modify other users' data
8.2 Safe Harbor
We will not pursue legal action against researchers who:
- Act in good faith
- Report vulnerabilities promptly
- Avoid privacy violations and data destruction
- Give us reasonable time to respond
8.3 Bug Bounty
We currently operate a [private/public] bug bounty program. Contact us at [SECURITY_EMAIL] for details.
9. Employee Security
- Background checks for employees with data access
- Security awareness training
- Principle of least privilege access
- Regular access reviews
- Secure development training
10. Contact Security Team
For security-related inquiries or to report a vulnerability:
- Email: [SECURITY_EMAIL]
- PGP Key: Available upon request
- Response Time: Within [24] hours for security reports