Security
How we protect your account, your sites and your data, and how to report a vulnerability.
DRAFT: not legal advice; to be reviewed by a lawyer before launch. Text in highlighted square brackets, like [Registered address], is a placeholder still to be filled in.
On this page
Security is a core part of how we build and run EzyStudio. This page gives an overview of the measures we use to protect your account, your sites and your data, and explains how to report a security issue.
1. Overview
We use administrative, technical and physical safeguards designed to protect the Services and the data entrusted to us. We review and improve these measures regularly as the Services and the threats to them change.
2. Encryption
Data is encrypted in transit and at rest. Sensitive values, such as passwords, credentials and keys, are protected with industry-standard techniques.
3. Access control
Access to the Services is controlled by roles and permissions. Access to customer data by our personnel is limited to those who need it to provide and support the Services, and is logged.
4. Isolation
Customer environments are logically separated from one another and from our internal systems.
5. Payments
Payments are processed by a PCI DSS compliant payment provider. We do not store full card numbers.
6. Availability and backups
We maintain backups and recovery procedures designed to protect against data loss. We recommend that you also keep your own copies of content that matters to you.
7. Our providers
We use established infrastructure and service providers that are bound by contractual security obligations. Our current list is on our Sub-processors page.
8. Incident response
We maintain procedures to detect, investigate and respond to security incidents. If we become aware of a security incident affecting your Personal Data, we will notify you without undue delay as required by law and our agreements, including our Data Processing Addendum.
9. Your responsibilities
Security is shared. You are responsible for keeping your login credentials confidential, managing who has access to your workspace, keeping keys and credentials out of your code, reviewing what you build before you publish it, and securing the third-party accounts you connect, including your AI provider account.
10. Report a vulnerability
If you believe you have found a security vulnerability in EzyStudio, contact [security contact email] with enough detail for us to reproduce it. The same contact is published in our security.txt file.
When researching, only test against accounts you own, do not access or keep other users’ data, do not disrupt the Services, and give us reasonable time to resolve the issue before disclosing it. We will not take legal action against good-faith research that follows these guidelines.