Security
Data, hosting, payments, deletion.
What lives where, who can touch it, and how to remove it.
Hosting
Application, database, and generated video files all live on Supabase in the EU (Frankfurt region). Static assets and serverless functions run on Vercel.
Database
PostgreSQL via Supabase. Row Level Security enabled on every public table. Service role keys never leave the server bundle.
Encryption
TLS 1.2+ in transit (HSTS preload, max-age two years). Disk encryption at rest via Supabase Storage.
Authentication
Email and password (passwords are hashed and managed by Supabase Auth, never stored in plain text), plus Google and Telegram sign-in. CSRF protection enforced at the edge; session cookies are SameSite=Lax.
Payments
Stripe Checkout (PCI-DSS Level 1). We never see your card number. Stripe returns a customer ID we associate with your account. Webhooks are signature verified.
Content security
Strict CSP (script-src restricted to first party plus Stripe, Telegram, Cloudflare Turnstile, Vercel analytics). X-Frame-Options SAMEORIGIN. Permissions-Policy blocks camera, microphone, and geolocation by default.
AI bot access
Robots policy explicitly allows GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot, Google-Extended, Applebot-Extended, and CCBot for marketing pages. Authenticated routes (/dashboard, /api, etc.) are disallowed for every crawler.
Generated content ownership
You own every clip you approve. We do not use your content or likeness to train generative models; the only models built from your uploads are your own creator models and voice clones, used exclusively for your account. We do not redistribute your videos. We do not reveal your discovery sources to other accounts.
Backups
Supabase point in time recovery covers the last 7 days on Pro tier. Generated video files are durable in Supabase Storage; deleted files are unrecoverable after the soft delete window.
Account deletion
Email support@viralgen.ai from your account email to request deletion. We remove your profile, scheduled posts, reel items, generated videos, Stripe customer reference, and authentication record within 30 days. The action is irreversible.
Incident contact
Email security@viralgen.ai with a clear description and a contact method. We acknowledge within one business day.
Subprocessors
Stripe (payments), Supabase (database + storage), Vercel (hosting + edge runtime), third-party data providers, Wavespeed (AI inference), Cloudflare Turnstile (bot mitigation).