Security

• Passwords are hashed with Argon2id — we never store or can see your plain-text password.
• Sign-in sessions use short-lived access tokens with automatic rotation; a stolen or replayed refresh token is detected and immediately revokes the entire session family.
• You can view and revoke active sessions/devices at any time from Account → Sessions.
• Sensitive admin actions (deleting a user, impersonating an account) require a fresh re-authentication ("sudo mode") in addition to being signed in.

• Third-party service credentials (payment provider keys, AI provider keys) are encrypted at rest (AES-256-GCM) and never exposed in admin API responses.
• Role-based access control restricts what admin staff can see and do; every admin action is written to an audit log.
• All traffic is served over HTTPS in production.

• All AI-generated text and images pass through automated content-safety checks before they’re shown or stored.
• A random sample of auto-approved content is additionally spot-checked, and anyone can report content they believe is unsafe.
• Accounts that repeatedly publish unsafe content lose public-sharing privileges.
• Global rate limiting protects the service against abusive request volumes.

If you believe you've found a security vulnerability, please report it privately to security@stogenai.com rather than filing a public issue. We aim to acknowledge reports within 1 business day, and to credit responsible disclosure once a fix ships. Internally, a full-outage or data-safety incident (including anything that could expose children's data or serve unsafe content) is treated as our highest-severity incident, with an on-call response targeted within 15 minutes — see our incident response runbook for the full severity levels and escalation process.