Skip to content
Fraiwy
Security

Security at Fraiwy.

How we protect your account, your content and your payments — stated plainly, with nothing on this page we can't back up.

Account & authentication

  • Sign-in is handled by Supabase Auth (email and OAuth). Sessions use short-lived JWTs that our API verifies on every request — there are no shared or long-lived server keys per user.
  • Optional two-factor authentication (TOTP) with session step-up: once you enroll a factor, a fresh challenge is required to elevate a password login.
  • Studio, library, jobs and account routes are gated at the edge before any page code runs.

Encryption

  • All traffic is encrypted in transit with TLS, enforced by HSTS (preload).
  • Data at rest — your account, generations and uploads — is stored with AES-256 encryption by our infrastructure providers (Supabase/Postgres, Cloudflare R2).

Payments

  • Checkout and billing run entirely on Stripe-hosted pages. Card numbers never touch Fraiwy servers.
  • Stripe webhooks are signature-verified and processed at most once — replayed or duplicated events cannot double-charge or double-credit an account.
  • Credits are only ever granted on a confirmed payment event.

Application hardening

  • Strict Content-Security-Policy, X-Frame-Options: DENY, nosniff and related headers on every page.
  • Redis-backed rate limiting across all API replicas, plus stricter per-route limits on write endpoints.
  • Server-side request validation, request body-size limits, and SSRF protection on any fetch of an external URL you provide.
  • The browser never talks to AI providers directly — every generation goes through our API and job queue, so provider keys never leave our servers.

Your content

  • You own what you generate. Outputs live in your private library unless you explicitly publish them to the community.
  • Account deletion is built in: deletion requests soft-lock the account immediately and permanently purge data after a recovery grace period.

AI content marking

  • Images, video and audio generated in Fraiwy carry machine-readable AI-provenance metadata — the IPTC digital source type (trainedAlgorithmicMedia) embedded as XMP for images and video, and as ID3/RIFF tags for audio.
  • Where a model provider embeds its own C2PA Content Credentials (cryptographically signed provenance manifests), Fraiwy preserves them byte-for-byte — our pipeline never strips provenance metadata.
  • Content published to the community feed is visibly labeled as AI-generated.
  • When you distribute AI content that shows real people doing things they didn't do — face swaps, voice clones — EU law (AI Act, Art. 50(4)) may require you to disclose that it is AI-generated. Our Terms of Service require the depicted person's permission and that disclosure.

Certifications

  • We do not currently hold formal certifications such as SOC 2 — and we won't claim them until an independent auditor says so. When we complete an audit, the attestation will be published here.

Found a vulnerability?

Report it privately and we'll respond quickly. Contact details and our disclosure policy live at /.well-known/security.txt. Please don't test against other users' accounts or data.

Live service health is published on the system status page.