Security
Private by design.
Secure by default.
Rewriting means trusting us with your words. Here is exactly how we protect them — no enterprise plan required.
Data protection
Encryption at rest
Submitted text, rewritten output, contact messages and two-factor secrets are encrypted with modern authenticated encryption, using keys that never leave our servers.
Encryption in transit
All traffic is served over HTTPS with HSTS. Calls to our GPU workers and payment provider use TLS.
Retention & deletion
Text is erased automatically after 30 days. You can delete any rewrite or your entire account instantly.
No training, no third-party AI
Rewrites run on our own private model. Your text is never sent to another AI provider or used to train models.
Account security
Two-factor authentication
TOTP authenticator apps with single-use recovery codes and replay protection. Mandatory for administrators.
Modern password storage
Passwords are hashed with Argon2id. New passwords are screened against known breaches using a k-anonymity lookup — your password never leaves our server.
Session protection
HttpOnly, SameSite, __Host- prefixed cookies; IDs rotate on login and periodically; idle timeouts; one-click "sign out everywhere".
Audit trail
Sign-ins, failed attempts, password and 2FA changes and API key events are logged and visible to you under Security.
Application security
Strict Content-Security-Policy
No inline scripts, no eval, no third-party JavaScript. All assets — including fonts — are self-hosted.
Defence in depth
CSRF tokens on every form, rate limiting on sign-in and APIs, clickjacking protection, strict referrer and permissions policies.
Verified crypto payments
Every crypto payment is confirmed directly with the payment processor before credits are added — never from an unverified callback — and only the full amount counts. Credits are granted exactly once.
Least-privilege secrets
API keys and one-time tokens are stored only as hashes. GPU callbacks use single-use, per-job tokens.
Responsible disclosure
If you believe you have found a security vulnerability, please report it to us privately. We will acknowledge your report within 3 business days and keep you updated as we investigate.
- Email [email protected] or use the contact form with the “Security report” topic.
- Include steps to reproduce, affected URLs and the potential impact.
- Do not access, modify or delete other users' data, degrade the service, or use social engineering.
- Give us reasonable time to fix the issue before any public disclosure.
We will not pursue legal action against researchers acting in good faith under these guidelines. Our machine-readable contact details are published at /.well-known/security.txt.