AiBrush Studio runs in your browser against cloud services we operate. This page explains, at a level that is useful without being a blueprint, how accounts, media, payments, and the AI providers behind the studio are protected, and how to report a problem.
Sign-in is handled by Google through Firebase Authentication; AiBrush never sees or stores your Google password. Every request from the browser to our backend carries a short-lived identity token that the backend verifies on each call, including a check for revoked sessions.
Your AiBrush account is tied to that identity. Signing out ends the session in that browser, and removing AiBrush from your Google account ends it everywhere.
Uploaded and generated media is stored in private object storage and delivered through a content delivery network. The records that describe your workspace and media are scoped to your account: the database rules that guard them only allow reads by the signed-in owner and allow no writes from the browser at all.
Downloads that go through our own proxy are limited to our media hosts and are served with private, no-store cache headers, so a per-user file never lands in a shared cache. Ad Studio runs in an isolated per-user workspace; one user’s workspace cannot read another user’s files, conversations, or credentials.
Card details are entered on Stripe-hosted checkout and billing pages, never on aibrush.co. AiBrush stores a Stripe customer reference together with subscription and credit-ledger records, not card numbers. Billing events that Stripe sends us are verified with Stripe’s signature before they change anything on your account.
A generation request is sent to the AI provider that runs the selected model with only the inputs needed for that request. Provider credentials live on our servers as platform secrets and are never sent to the browser. Our services run on major cloud platforms with access restricted to the AiBrush team, and secrets are injected at deploy time rather than stored in code.
Every plan has request rate limits, and credits are reserved before a generation starts so a runaway job cannot spend more than you hold. An automated check blocks face-swap requests that involve minors, and the AI providers apply their own content safety filters on top. Operational logs and error monitoring let us investigate incidents, and analytics session recordings mask everything you type.
If you find a vulnerability, email support@aibrush.co with “Security report” in the subject line. Include the affected URL or feature, the steps to reproduce it, and what you observed. Please do not include payloads that would damage data, and do not test against other users’ accounts or media.
We acknowledge every genuine report, keep you informed while we fix the issue, and ask that you give us reasonable time to do so before any public disclosure. We do not currently run a paid bug-bounty programme.
This overview describes controls that are in place today. It is not a certification, a penetration-test report, or a service-level guarantee. If you need a specific assurance for a procurement or compliance review, contact us.