Security

Accounts sign in with email and password or Google. Sessions are managed by our authentication provider, and every workspace route requires an authenticated session.

Projects, jobs, credits and assets are scoped per account with row-level access rules enforced in the database, so one workspace cannot read another's records.

Uploads and generated assets are held in private buckets. Files are served through short-lived signed URLs rather than public links.

AI provider credentials, including the image processing key, are stored server-side and used only inside authenticated server functions. The browser never receives or calls a provider directly.

Card details are handled by Stripe and mobile money by Safaricom M-Pesa. We do not store card numbers. Payment callbacks are signature-verified before any credit is granted.

All traffic to the studio and its APIs is served over HTTPS.

We secure the platform, its infrastructure and provider integrations. You are responsible for protecting your credentials, managing who has access to your workspace, and confirming you hold the rights to the imagery you upload.

Send findings to security@megabridgedigital.com. Please include reproduction steps and give us reasonable time to remediate before public disclosure.