Security

• Passwords are hashed with Argon2id — we never store or can see your plain-text password.
• Sign-in sessions use short-lived access tokens with automatic rotation; a stolen or replayed refresh token is detected and immediately revokes the entire session family.
• You can view and sign out your active devices at any time from Account → Settings. An account can be signed in on at most 3 devices at once.
• Sensitive admin actions (deleting a user, impersonating an account) require a fresh re-authentication ("sudo mode") in addition to being signed in.

• Third-party service credentials (payment provider keys, AI provider keys) are encrypted at rest (AES-256-GCM) and never exposed in admin API responses.
• Role-based access control restricts what admin staff can see and do; every admin action is written to an audit log.
• All traffic is served over HTTPS in production.

• All AI-generated text and images pass through automated content-safety checks before they’re shown or stored.
• A random sample of auto-approved content is additionally spot-checked, and anyone can report content they believe is unsafe.
• Accounts that repeatedly publish unsafe content lose public-sharing privileges.
• Global rate limiting protects the service against abusive request volumes.

If you believe you've found a security vulnerability, please report it privately to support@stogenai.com rather than filing a public issue. We aim to acknowledge reports within 2 business days, and to credit responsible disclosure once a fix ships. Anything that could expose children's data or serve unsafe content is treated as our highest priority.