Security & AES-256 Encryption

API key encryption

BYOK (bring-your-own-key) credentials are encrypted at rest with AES-256-GCM. We never store provider keys in plaintext in the database. Decryption happens in application memory only when your account initiates a generation or tool call that needs that provider. Keys are not exposed to other users and are not embedded in client-side JavaScript.

You can rotate or delete keys from Dashboard → API Keys at any time. After deletion, ciphertext for that key is removed with the record.

Application security

• HTTPS for all production traffic
• CSRF tokens on state-changing forms and many authenticated POSTs
• Password hashing suitable for modern web apps (not reversible storage)
• Optional two-factor authentication for accounts that enable it
• Rate limiting on login, registration, and sensitive API-style endpoints
• Brute-force protections with lockouts and security event logging
• Security-focused HTTP headers (including Content-Security-Policy and frame controls where configured)

Manuscript & project data

Your projects live in our application database so the studio can show outlines, chapters, diffs, and exports. Access is scoped to your account (and to people you explicitly share with — for example beta-reader links). Staff access for support or abuse investigation is limited and audited.

Browser-only writing tools under /tools that analyze text locally do not upload manuscript content for those scans. Features that intentionally save or generate on the server (cloud save, signed-in AI tools) only process what you submit.

Third-party AI providers

Generation requires sending prompts and context to the model provider you select (or to our built-in Free/Pro routing). Those providers process data under their own security and privacy terms. Choose providers you trust; use project-scoped keys with spend limits when your vendor supports them.

Audit logging & abuse response

We log security-relevant events such as logins, lockouts, and privileged admin actions. Logs are used for operations and investigation, not marketing. We may suspend accounts that abuse shared Free AI pools, attack the service, or violate the Terms.

If you believe you found a vulnerability, contact us via the contact form with enough detail to reproduce. Please avoid testing that degrades service for other authors.

What you can do

• Use a unique password and enable 2FA when available
• Prefer provider keys with low spend caps for drafting
• Unpublish public stories you no longer want indexed
• Request account deletion when you leave the service

Security FAQs for AI book writers

Who can read my manuscript?

Projects are scoped to your account (and people you explicitly share with, such as beta-reader links). Staff access for support or abuse investigation is limited and audited. Public stories you choose to publish can be indexed — unpublish when you no longer want them public.

Is bring-your-own-key safer than built-in AI?

BYOK keeps billing and provider choice under your control; keys stay AES-256 encrypted at rest. Built-in Free/Pro AI still sends prompts to the routed model under our operational controls. Either way, generation requires sending text to a model provider — pick vendors you trust.

Do free browser tools upload my novel?

Local analyzers under /tools process text in your browser for those scans. Cloud save and signed-in AI features only process what you intentionally submit.