How We Protect Your Data
What we actually do to protect your account, your content and your payments — and what we don’t claim. ProofAI does not hold SOC 2 or ISO 27001 certification yet.
What We Log
Your text and files are used only to produce your result and are not saved by ProofAI. To analyse them we send them to AI model providers listed in our privacy policy. We keep a record of each check (date, type and score, not your content); signed-in users see it in their history.
Content: Not Saved
Text, files and images are used only to produce your result
Check Records: Kept
Date, type, score, verdict and source of each check
Visitors: Kept
Visitor ID, IP address and hashed fingerprint for the free limit
AI Providers
Content is sent to the providers listed in our privacy policy to analyse it
Infrastructure & API Protection
3. Secure Infrastructure
Encryption
HTTPS/TLS via Cloudflare for all traffic
Protection
Cloudflare network security in front of our servers
Hosting
Servers operated by 4Born Solutions
Uploads
Processed in memory or temp files, deleted after analysis
4. API Security
Authentication
Secret API keys, stored only as hashes
Restriction
Domain-based Access Control
Rate Limits
Enforced Plan-based Quotas
Key Control
Create and delete keys from your dashboard
Access & Operational Security
5. Account Protection
Hashed, breach-checked passwords, sign-out of other sessions on password change, and rate-limited sign-ins.
6. Payment Security
Payments are processed by Cashfree; we never see or store full card details. Payment notifications are signature-checked.
7. Abuse Prevention
Request rate limits, daily usage limits and a CORS allow-list.
Internal Security Controls
8. Internal Access
Access to servers and the database is limited to 4Born staff who need it to run ProofAI.
9. Third-Party AI Processors
Content is sent to AI model providers to analyse it. See the list in our privacy policy (section 8).
10. Breach Notification
We will notify affected users and the Data Protection Board as required by law.
Responsibility & Improvement
11. User Responsibilities
- Protecting account credentials
- Securing generated API keys
- Lawful use of the platform
12. Continuous Improvement
We apply security updates and fix reported issues. Found something? See “Report a Vulnerability” below.
Security is not a one-time effort. It is an ongoing commitment at ProofAI.
Report a Vulnerability
How to report
Email [email protected] with the subject “Security report”, the affected URL and steps to reproduce. Please do not access other users’ data, run denial-of-service tests or publish the issue before we have fixed it. We will acknowledge your report and keep you updated. Our security.txt has the same details.
If something goes wrong
If a personal data breach affects you, we will notify affected users and the Data Protection Board of India as required by law, explain what happened and what we are doing about it.
ProofAI does not hold SOC 2 or ISO 27001 certification yet. We describe only the controls we actually run.
Security controls in the product
These are the specific technical measures that protect your account, your content and your payments.
| Area | What we do |
|---|---|
| Uploads | Files you check are used only to produce your result and are deleted after analysis (25 MB limit); to analyse them we send them to the AI model providers listed in our privacy policy. Profile pictures are verified by their actual file contents, not just their extension, and served with protective headers. |
| Passwords | Passwords are hashed, must be 8–128 characters, and are checked against lists of common and breached passwords (using a privacy-preserving range query that never sends your password). |
| Sessions | Changing or resetting your password signs out all other sessions. Password-reset links are single-use, stored only as a hash and expire after 30 minutes. |
| Brute-force protection | Repeated failed sign-ins are rate-limited per account and per network, and email actions (verification, reset) are rate-limited. |
| API keys | Keys are stored only as hashes, can be restricted to your domain, and the number of active keys is limited per plan. |
| Payments | Payments are processed by Cashfree; we never see or store full card details. Payment notifications are verified with a cryptographic signature and a replay window before any plan is activated. |
| Browser security | Requests are accepted only from ProofAI’s own sites and approved apps (CORS allow-list), and error messages never reveal internal details. |
| Detection engine key | The key for our detection engine stays on our servers; the browser only talks to our own API, which also enforces usage limits. |
What you can do
Security is shared. A few simple habits keep your account safe:
- Use a unique password for ProofAI, or sign in with Google.
- Restrict API keys to your own domain and delete keys you no longer use.
- Never share API keys in public code or screenshots.
- Only upload content you are allowed to process, especially other people’s documents.
Frequently Asked Questions
Uploaded files are used only to produce your result and are deleted after analysis; they are sent to the AI model providers listed in our privacy policy to analyse them. Signed-in users keep only scores and verdicts in their history.
Passwords are hashed and checked against common and breached password lists when you set them. Changing your password signs out your other sessions.
No. Payments are handled by Cashfree, and payment confirmations are verified with a cryptographic signature.
Email [email protected] with the subject “Security report” and details. Please do not test against other users’ accounts or data. Our security.txt is at /.well-known/security.txt.
Related tools and guides
Last updated: 16 October 2026
Need More Security Details?
Email [email protected] with the subject “Security report” for vulnerabilities, or ask us about data handling and security questionnaires.