Security

You connect your HighLevel account and your AI key to us, and your customers send us their photos. This page explains how we protect them.

Your keys and tokens

• OpenRouter keys and HighLevel tokens are encrypted with AES-256-GCM before they are stored.
• They are only decrypted on our servers, at the moment they are used. They are never sent to your browser or written to logs.
• The app only ever shows the last few characters of a key.

Photos and results

• Photos are stored privately. Links to them are signed and expire, so a photo can't be found by guessing its address.
• All traffic uses HTTPS, and stored data is encrypted at rest by our hosting providers.
• Photos are deleted after 12 months unless you choose to keep them longer.

Access control

• Every request is checked against your account and role, on the server.
• Agency client logins only see the locations they have been given.
• Row-level security in the database adds a second barrier between accounts.
• Actions by our own support staff are recorded in an audit log.

Incoming data

• Messages from HighLevel and payment events from Stripe are checked for a valid signature before we act on them.
• Uploaded files are checked for type and size before they are processed.

Infrastructure

The app runs on Vercel and stores data with Supabase, both in the United States. Card payments are handled entirely by Stripe; card numbers never reach our servers.

Reporting a vulnerability

If you think you've found a security problem, email support@aiphototransformation.com with the details. Please give us a reasonable time to fix it before telling anyone else. We won't take action against good-faith research that avoids harming our customers or their data.