Security at PurifyAI Studio
Our security model starts with an unusual advantage: the core processing engine runs locally in your browser, eliminating the most common attack vectors at the architecture level.
Our Core Security Advantage
Traditional SaaS tools upload your files to servers — creating a centralized attack surface for data breaches. PurifyAI's WASM engine runs directly in your browser tab. There are no files in transit to intercept, no server-side storage to breach, and no S3 buckets to misconfigure. This is security through architecture.
Zero-Server File Architecture
Our WASM processing engine runs entirely in your browser. Files are never transmitted over the network — making it architecturally impossible for us to store or intercept your content.
Content Security Policy
Strict CSP headers prevent cross-site scripting (XSS) attacks. We block inline script execution and only allow resources from our own domain and verified CDNs.
End-to-End Encrypted Auth
Passwords are hashed with bcrypt (cost factor 12). JWTs use RS256 asymmetric signing. Sessions are HTTP-only cookies with SameSite=Strict and Secure flags.
TLS 1.3 Everywhere
All connections use TLS 1.3 with HSTS preloading. We reject TLS 1.0/1.1 and weak cipher suites. Certificate transparency logging is enabled.
Rate Limiting & DDoS Protection
API endpoints are protected by rate limiting, IP reputation filtering, and Cloudflare's DDoS mitigation. Abuse patterns trigger automatic throttling.
API Key Security
Developer API keys use cryptographically random 256-bit tokens. Keys are stored as HMAC hashes — we cannot see your raw key. You can revoke keys instantly at any time.
Compliance & Certifications
Responsible Disclosure
If you discover a security vulnerability, please report it responsibly. We investigate all reports and acknowledge valid findings publicly with your permission.
Report a Vulnerability → security@purifyai.app