Security
HTTPS and Encryption
All communication between your browser and our servers is encrypted using TLS 1.3. All API requests and responses are transmitted over HTTPS. This ensures that your data, including prompts, generated content, and authentication tokens, cannot be intercepted or modified in transit.
Data Storage
Passwords are never stored in plain text. They are hashed using bcrypt with a cost factor of 10 before being stored in our database. Authentication is handled via short-lived JWTs stored in localStorage, not cookies, which protects against CSRF attacks.
Infrastructure
Our infrastructure runs on encrypted cloud servers with strict access controls. Database access is limited to application-level credentials with no direct public access. Regular security audits and dependency updates are performed to address vulnerabilities.
Data Handling
Generated images and videos are stored securely and are only accessible to the account that created them. Prompts and generation metadata are stored for service operation and improvement. We do not share your generations with third parties without your consent.
Vulnerability Disclosure
If you discover a security vulnerability, please report it responsibly to security@omnis-studio.com. We will acknowledge receipt within 48 hours and work to resolve the issue promptly.