Security
Security at Create
Here is how Create handles your data and accounts today. We have no formal security certification yet, and we say so below.
Last updated October 2026
How we run
Plain facts about how Create is built and run.
No formal certification yet
Create has not been through a formal third-party audit or certification, such as SOC 2 or ISO 27001. We say so plainly so you can decide what fits your needs.
A small team
Create is built and run by a small team. Access to production systems is limited to the people who need it.
Limits that protect your account
Requests are checked before credits are used. Each person can only run a few generations at once, and we have a switch that can pause generation if something goes wrong.
Reporting a problem
If you find a security issue, use the contact link on this page. We read every report.
Cloud and data
Where your data lives and how it is protected in transit and at rest.
Established providers
Create runs on Vercel. Accounts, data, and files are stored with Supabase. Payments are handled by Stripe. These providers run their own security programs.
Encryption in transit
Traffic to and from Create uses HTTPS (TLS), and browsers are told to always use it.
Encryption at rest
Our database and file storage providers encrypt stored data at rest.
Private files
Files you upload and results you make are kept in private storage and are shown through short-lived signed links.
Row level security
Our database uses row level security, so one account cannot read another account's rows.
Backups
We rely on our database provider's backups. We do not promise a specific recovery time.
Accounts and access
How you sign in and how your account is protected.
Signing in
Sign in with an email and password, or with a connected account such as Google. Passwords are handled by Supabase Auth.
Cross-site protection
Requests that change data are blocked when they come from another website.
Delete your account
You can delete your account from your account settings.
Vendors and your content
Who else handles your prompts, files, and payments.
AI providers
Your prompts and the files you upload are sent to the AI companies that run each tool, such as Google, OpenAI, and others reached through the Vercel AI Gateway. Their terms also apply. See our privacy policy.
Payments
Card details go to Stripe. Create does not store card numbers.
Questions about your data
Send questions about your data through the contact link on this page.
Contact us
If you have questions or want to report a potential security issue, reach out to our team.
Report a security issueStart creating.
