How STEALTH protects your work

Sign-in is handled by our managed authentication provider. We support email/password and Google sign-in. Sessions are stored in your browser and can be revoked by signing out.

Administrative actions are gated by server-side role checks, not by client state. Role assignments live in a dedicated table separate from user profiles.

Every user-data table uses row-level security. Policies scope reads and writes to the signed-in user (or their organization), enforced inside the database. Billing identifiers such as Stripe subscription IDs are restricted to organization owners and admins.

Usage and credit ledger entries are written only by trusted server-side functions — clients cannot fabricate billing or usage records.

Project data (prompts, generated images, videos, audio, library items) is stored in our managed backend. Generated media lives in a private storage bucket and is served through short-lived signed URLs — there are no public file links.

Connections to the database and storage are encrypted in transit (TLS). Data at rest is encrypted by our infrastructure provider.

You choose what to share. Organization members see organization-scoped projects and assets; personal projects remain visible only to you. Invites are token-based and expire.

Prompts and assets you submit are sent to the AI provider you select (image, video, voice, music, or chat model) to fulfil your request. API keys for these providers are stored as server-side secrets and never shipped to your browser.

We do not train models on your content. Provider data-handling terms apply to the request you make to them.

You can export or delete your account data by signing in and visiting your profile, or by emailing the address below. We respond to verified requests as quickly as we reasonably can.

Security disclosures and privacy requests: security@stealth-ai.net