Security architecture
Security at PurifyAI Studio
Our security model starts with an unusual advantage: the core processing engine runs locally in your browser, eliminating the most common attack vectors at the architecture level.
Controls
Local file processing
The Studio, Batch Scrubber and browser extension process your media entirely on your device — open your network tab and watch: there is no upload. The optional Agency REST API is the one exception, and it is opt-in; see "Where the API differs" below.
Password storage
Passwords are hashed with scrypt at OWASP-aligned parameters (N=2^16, r=8, p=1 — roughly 64 MB of memory per verification), with a per-user random salt and a server-side pepper held outside the database.
Session handling
Sessions are opaque random tokens, not JWTs — stored as HMAC-SHA256 digests, so a database copy cannot be replayed. Cookies are HttpOnly, Secure and SameSite=Lax, backed by an Origin check and a double-submit CSRF token. Sessions idle out after 12 hours, expire absolutely at 14 days, and rotate every 30 minutes.
API key security
Developer API keys are cryptographically random 256-bit tokens. Only an HMAC-SHA256 digest is stored — we cannot show you a key again after it is created, and we cannot recover it. Keys can be revoked instantly.
Rate limiting
Authentication, password reset and API endpoints are rate limited in the database, per identifier and per IP. Transport-level DDoS absorption is whatever our host provides; we do not claim a scrubbing layer we do not operate.
Two-factor authentication
TOTP enrolment with single-use recovery codes. The shared secret is encrypted at rest with AES-256-GCM under a key held in the environment, not in the database.
Content Security Policy
Every response carries a CSP. On the workspace, admin and auth routes it is nonce-based with strict-dynamic, so injected inline script will not execute; the prerendered marketing pages use a weaker policy that still permits no eval and no third-party origin. Framing is denied outright, object-src is none, and the payment provider is allowed on the billing route alone.
Transport & browser hardening
HSTS with a two-year max-age and preload, MIME sniffing disabled, a cross-origin opener and resource policy of same-origin, a strict-origin referrer policy, and Permissions-Policy denying camera, microphone, geolocation and USB.
Compliance
PurifyAI Studio holds no third-party security certification today. We are not SOC 2 audited and not ISO 27001 certified, and we would rather say so than display a badge that implies an audit nobody has performed.
We apply the GDPR and CCPA rights we are able to honour directly: you can export or delete your account data from the workspace, and file content is not retained to begin with. Account data (email, password hash, plan, usage counters) is stored in Postgres hosted in AWS us-east-2 in the United States — if EU data residency is a requirement for you, we do not meet it today.
Responsible disclosure
If you discover a security vulnerability, please report it responsibly. We investigate all reports and acknowledge valid findings publicly with your permission.
Report a vulnerability: security@purifyai.app