Security and
Disclosure.

Transport and browser hardening

• HTTPS only, with HTTP Strict Transport Security including subdomains and preload.
• An enforced Content Security Policy restricting scripts, frames, form targets and connection endpoints to an allowlist.
• Cross-Origin-Opener-Policy, X-Content-Type-Options and a restrictive Permissions-Policy that denies camera and geolocation.
• Framing restricted by Content-Security-Policy frame-ancestors.

Identity and authorisation

• Authentication by Google Firebase Authentication with email verification, or Google sign-in. Passwords are never stored by us in readable form.
• Every AI, media and metering endpoint verifies a signed account identity token before doing any work, and rejects unauthenticated requests.
• Database and object storage rules restrict each account to its own records and files, with server-authoritative entitlement and quota checks.
• Per-account rate limiting and short-window call budgets to contain abuse and runaway cost.

Data and secrets

• Encryption in transit between all components, and encryption at rest by default on the managed database and object storage services we use.
• Application secrets held in Google Secret Manager, pinned to explicit versions, never committed to source control.
• Least-privilege service credentials, with keys rotated when a change of scope or a suspected exposure requires it.
• Generic error responses to the browser so that upstream provider messages and internal details are not disclosed.

We would rather be accurate than impressive, so to be explicit:

• Seamix AI does not hold ISO 27001 certification and does not have a SOC 2 report. Our cloud providers hold their own certifications; those do not transfer to us.
• We do not currently run continuous third-party penetration testing or a paid bug bounty.
• We do not offer customer-managed encryption keys, single tenancy, a private VPC deployment or on-premises hosting.
• We do not use blockchain or any distributed ledger, and we make no cryptographic integrity guarantee beyond the platform controls described above.
• No system is completely secure. We aim to reduce risk, not to promise its absence.

If you believe you have found a security vulnerability, email security@seamix.ai with a description, the steps to reproduce, and the impact you believe it has. We aim to acknowledge within 3 working days and to keep you updated until the issue is closed.

Safe harbour

We will not pursue or support legal action against you for good faith security research that follows the rules below, and we will treat such research as authorised under the Acceptable Use Policy.

• Test only against your own account and your own data.
• Do not access, modify, exfiltrate or delete data belonging to anyone else, and stop as soon as you confirm a vulnerability exists.
• Do not run denial-of-service, load, spam or physical or social engineering tests against us, our staff or our providers.
• Do not use automated scanners that generate high request volumes against production.
• Give us a reasonable period, normally 90 days, to remediate before publishing, and do not disclose customer data at any point.

We do not currently pay bounties. We are happy to credit reporters publicly with their permission.

If a security incident affects personal data and is likely to result in a risk to individuals, we will notify the Information Commissioner's Office within 72 hours of becoming aware, notify affected users without undue delay where the risk is high, and notify controller customers within 48 hours under the Data Processing Addendum. We will describe what happened, what data was involved, what we have done and what you should do.