Security overview

Infrastructure

Äng runs on Vercel (hosting and edge network) and Supabase (database, authentication, and object storage). Both providers maintain SOC 2 compliance and support data residency in the EU.

• Encryption in transit — All network traffic is encrypted in transit using HTTPS/TLS. Vercel redirects HTTP to HTTPS, renews TLS certificates automatically, and serves HSTS so browsers refuse cleartext connections to the production site.
• Vercel — Hosting and edge network, DDoS protection, and the Vercel AI Gateway for multi-provider model routing.
• Supabase — Postgres with row-level security (RLS) enabled. RLS and active board-membership checks ensure only invited members can reach a board's data, and that viewers cannot write. Authentication uses Supabase Auth (OAuth via Google, magic link email).

Authentication

Supported methods are Google OAuth and email magic link. Passwords are never stored. Sessions use short-lived tokens that are refreshed automatically and never appear in the browser URL.

Content Security Policy

Every page response includes a strict Content Security Policy (CSP) with a per-request cryptographic nonce, so only scripts our server sends can run, and the browser may only connect to an allowlist of services.

CSRF protection

All state-changing API requests (POST, PUT, PATCH, DELETE) are checked with same-origin Origin / Referer validation. Cross-site requests are rejected with HTTP 403 before reaching any handler. Server-to-server endpoints authenticate with secrets or signatures instead of browser cookies.

Data isolation

Row-level security in Supabase enforces that only active members of a board can reach its boards and assets, and that viewers cannot write. This membership gate is enforced at the database level.

AI and third-party processing

Most AI image, video, and text generation runs through the Vercel AI Gateway to a curated set of providers, listed on the subprocessors page. fal.ai is called via a direct API integration for image-to-3D, Split into layers and PBR material extraction. When you generate or edit, the relevant prompt and media are sent to the provider that powers the model you selected, under that provider's terms. Those connections use HTTPS/TLS in transit; this is not end-to-end encryption — the selected provider processes the content to run the model.

Äng does not use your content to train its own models or share it for advertising. New accounts default to No training in Settings → AI, which limits the catalog to models offered on terms that exclude training on your inputs and outputs. Zero Data Retention (ZDR) is stricter and limits the catalog to models offered with zero data retention. Standard unlocks the full catalog and may allow providers to use inputs to improve their models per their own policies. See the privacy policy and subprocessors for details.

Error monitoring

Äng uses Sentry for error monitoring (EU – Frankfurt). Session replays are only recorded when an error occurs; all text is masked and all images are blocked in replays. See the privacy policy for full details.

Responsible disclosure

If you discover a security vulnerability, please report it using the in-app feedback form or email privacy@ang.studio. We aim to acknowledge reports quickly and to resolve confirmed issues promptly. We ask that you give us reasonable time to address the issue before public disclosure.