Your unreleased packaging is sensitive. We treat it that way.

Accounts

• Passwords are hashed with bcrypt; we never store or log them in plain text.
• Sessions are signed, HTTP-only cookies. Google sign-in uses OAuth through Auth.js.
• Sign-up, password reset, and public forms are rate limited per connection.

Data

• All traffic is served over HTTPS with HSTS. The app sets strict content-type, framing, and referrer headers.
• Brand kits, logos, projects, and generated art are scoped to your workspace on every request. Art is served only to signed-in members of the owning workspace.
• Uploaded logos are re-encoded server-side before storage, which strips embedded scripts and metadata.
• Payments are handled by Stripe. Card details never touch our servers.

AI providers

Prompts include your product line, mood, shelf, claims, and brand voice. They are sent to the configured model providers under their API terms, which do not use API data for training by default. Logos are never sent to model providers.

Reporting a vulnerability

Email security@labelkiln.com. We acknowledge reports within two business days, keep you updated, and do not pursue good-faith research that respects user privacy and avoids service disruption.