Azurade AI is built and run by Dubir Group LTD. This page says what we do to protect your account and your content, in concrete terms, and how to reach us if you find a hole.
Everything is served over HTTPS. Plain HTTP requests are redirected, and we send HTTP Strict Transport Security (HSTS) so your browser refuses to connect insecurely afterwards. Cloudflare terminates the connection at its edge and talks to our servers over a second, certificate-verified TLS connection. Calls to our payment, email and model providers are encrypted the same way.
You sign in with Google, with Facebook or with a one-time code that we email you; the code is valid for ten minutes and works once. We never ask you to invent a password, so there is no password of yours for us to lose. Each account does carry an internal random password that nobody ever sees, stored as a salted hash. Sessions use bearer tokens that expire after five days. When your account is used from a new browser or device, we email you about it.
Every record in our database is tied to one account, and the database enforces that rule on every request: a user can read and write only their own profile, balance and generations. Requests for someone else's data are refused by the server, not merely hidden by the interface. Files are the exception: each file you upload or generate is served through an unguessable link, so the web app, the API and AI agents can open it without signing in, and anyone you share a link with can download that file. The people who operate the Service reach the server over SSH with keys only, on a non-standard port, behind a firewall and an automatic ban for repeated failed attempts.
An API key can generate on your account and spend your credits, and it can read your email address, balance, generations and files. It can also start a card checkout for more credits, which goes through only if you pay it, and revoke itself. It cannot create keys, delete other keys, open the billing portal, cancel a subscription, or change or delete your account; those take your own sign-in. An AI agent can ask for a key on your account, and it gets one only after you sign in and type the code the agent showed you; the key then appears on your profile as "Agent". A new key is shown once, at the moment you create it, so copy it then. We store only a hash of it, the way passwords are stored, so nobody can read the secret back, not even us; your profile lists each key by name and its first characters, and lets you revoke it in a couple of clicks. Do the revoking, not the hoping, if a key ends up in a repository or a screenshot.
When you connect an app such as Claude or Cursor by signing in and clicking Allow, we hand that app a key of its own instead of showing one to you. It is stored the same way, listed on your profile under the app's name, and deleting it disconnects the app.
Subscriptions and credit packs are sold by Dodo Payments, our merchant of record, on PCI-DSS-certified checkout pages. You type your card details on Dodo's page, not ours, so a full card number never reaches or is stored on our servers. When Dodo tells us a payment went through, we check the cryptographic signature on that message before crediting a single credit, and we record each event once so a replayed message cannot credit you twice.
Your prompts and input files go to the third-party providers that run the models, and the finished image or video comes back to us through webhooks that we verify by signature before touching your gallery or your balance. If a generation fails, the credits are refunded by the same code path that recorded the charge. We do not train models on your prompts or outputs.
The application, its database and your files live on hardened servers in the European Union, with access limited to the operators who need it. Our hosting provider takes full-server backups. Security updates to the operating system and our dependencies are applied on an ongoing basis. Application logs are kept for five days, web-server access logs for up to ninety.
You can download every generation from your gallery, and you can ask us to close your account and delete its data by emailing legal@azurade.com. We do not sell your data. The Privacy Policy lists exactly what we keep, for how long, and who else sees it.
No system is perfectly secure, ours included. If a personal-data breach affects you, we notify you and the supervisory authority within the deadlines GDPR sets.
If you think you have found a security problem, email legal@azurade.com with the details and steps to reproduce. Give us a reasonable chance to investigate and fix it before you publish anything, and do not access or change data that is not yours while you test. We read every report and reply to the ones made in good faith.
Security reports: legal@azurade.com. Anything else: support@azurade.com.