1. Platform controls
- Encryption in transit (TLS) and at rest for stored media and database content.
- Row-level security on user data, with server-side authorisation on every privileged operation.
- Private object storage; media served only through short-lived signed URLs bound to an authenticated session.
- Hashed credentials, optional and enforceable two-factor authentication, verified-session tracking and session revocation.
- Signature-verified payment and provider webhooks with replay protection and atomic credit ledgers.
- Rate limiting, feature flags and abuse throttles on generation endpoints.
- Immutable audit logging of administrative actions, including role changes, credential edits and impersonation, each requiring additional authenticator verification.
- Least-privilege internal access, secret management outside source control, and dependency scanning.
2. Your responsibilities
- Use a unique, strong password and enable two-factor authentication.
- Keep your email account and authenticator device secure and never share one-time codes.
- Download the desktop application only from official Deepacal links.
- Report suspected compromise immediately to security@deepacal.com.
3. Incident response
We triage suspected incidents on discovery, contain and remediate, and notify affected users and, where required, regulators without undue delay and in any event within seventy-two (72) hours of becoming aware of a notifiable personal data breach. Notifications describe the nature of the incident, likely consequences and the steps taken.
4. Limitations
No platform is perfectly secure. Deepacal does not warrant that the Services will be free of vulnerabilities, and disclaims liability for compromise caused by your own credentials, devices, networks or third-party services, to the extent permitted by law.