Security, in plain terms.
No logo wall and no certifications we don't hold. Here's where your account, your content and your payments live, what protects them, and what we can't claim yet.
How we protect your data.
We build on managed providers that already run their own compliance programs, so where their controls apply — sign-in, payments, data at rest — they apply to you. Everything else below is ours, and it is described as it actually works.
Sign-in without passwords
Sign-in is passwordless: a one-time code sent to your email, verified at sign-up, or single sign-on with an account you already trust. There is no password for us to store, hash or leak. Sessions are issued and checked by a dedicated identity provider; on our side we keep its user ID, your email and the profile details you choose to give.
Application data
Projects, scripts, credit ledgers, brand kits and payment records live in a managed database, encrypted at rest and in transit, with point-in-time restore if something is deleted by mistake. Every record is tied to one workspace, and requests are scoped to the workspace you are signed in to.
Media and finished videos
Product images, rendered videos and avatar footage sit in encrypted object storage under random, unguessable paths, and the storage cannot be listed. Uploads go through short-lived signed URLs that pin the file type and size. One honest caveat: a finished video is served by direct link, so anyone you hand the link to can open it — share it the way you would share the file.
Encryption in transit
Every request between your browser, the app and the services behind it runs over TLS 1.2 or newer; older protocols are refused outright. Production sends HSTS so browsers never downgrade, plus frame, MIME-sniffing and referrer protections on every response.
Payments
Card details never touch our infrastructure. Checkout happens on the hosted page of a PCI DSS Level 1 payment processor; we receive a payment status and a reference, never a card number. Credits land in your workspace only after the payment is confirmed.
Every credit, on record
Credits move through an append-only ledger: every grant, hold, refund and debit is a row that is never edited or deleted, so any balance can be explained line by line. Payment records are archived, never deleted, and archiving records who did it and when.
What we don't claim.
We're a small team. Some things a mature security page would claim, we can't honestly claim yet. Here's where we are today.
- No SOC 2 or ISO 27001 report of our own yet.
We're a small team and haven't been through a formal audit. If your organization needs one, we can share our providers' audit reports on request — they cover the infrastructure your data actually lives on. Those providers are listed by name in the Privacy Policy and the Data Processing Agreement.
- No public bug bounty program yet.
We handle reports directly for now (see below) and will open a formal program once the volume justifies it.
- No 24/7 on-call.
Errors and failed renders are reported automatically and we get notified, but we're a small team: expect fast fixes during business hours and best-effort response outside them.
Found something? Tell us.
Email privacy@ugcabc.com with details and a proof-of-concept. Please give us reasonable time to investigate and patch before any public disclosure. We won't take legal action against good-faith security research that stays within our scope, avoids third-party data, and doesn't disrupt the service for other users.