Security

This page describes what Sceina actually does to protect your account and your content — and, at the end, what it does not do yet. We would rather be checkable than reassuring.

Encryption

• All traffic travels over HTTPS/TLS. Insecure requests are upgraded, never served.
• Data at rest is encrypted by our infrastructure providers, on both the database and object storage.
• Your media is never publicly accessible: every download goes through a short-lived signed URL, issued only after your ownership has been checked.

Accounts and authentication

Authentication is delegated to Clerk: signed sessions, support for two-factor authentication, password reset. Sceina never sees your password. Access through the MCP interface uses the same identity provider, so an agent connected to your account has exactly the same rights as you — no more.

Isolation between accounts

Every project, media file, render and cloned voice carries the identifier of its owner, and every read, write and delete path filters on it server-side. An identifier guessed or copied from elsewhere gets you nothing: the check happens on our side, never in the browser. Refused accesses are recorded so that a leak attempt leaves a trace.

Handling untrusted files and code

• The files you upload are decoded — probing, transcoding, font sanitising — by a separate service that holds no secret and no database access. A flaw in a media library therefore reaches nothing of value.
• Renders run in an isolated worker with a restricted system profile and filtered outbound network access.
• Custom components run in a sandboxed frame with a strict content security policy, cut off from the camera, the microphone, geolocation and payment.

Payments

Payments are handled by Stripe, certified PCI-DSS Level 1. No card number ever passes through our servers or is stored in our database. Only Stripe-signed events can credit a balance, and the signature is verified before any write — a forged call credits nothing.

Abuse and stability

• Sensitive endpoints — uploads, generations, exports — are rate limited per account.
• Idempotency keys prevent a retried request from charging you twice or duplicating a job.
• Every administrative action on an account is written to an immutable audit log, with its author, before it is carried out.

Report a vulnerability

If you believe you have found a flaw, write to [email protected] with the subject line SECURITY. We acknowledge receipt within 72 hours and keep you informed until it is fixed.

We will not take legal action against research carried out in good faith which stays on your own accounts, does not degrade the service, does not exfiltrate anyone else's data, and leaves us reasonable time to fix the issue before any publication.

What we do not claim

Sceina is a young product. We hold no SOC 2 or ISO 27001 certification, run no bug bounty programme, and have not yet commissioned an independent penetration test. If your organisation requires such guarantees, talk to us through Enterprise rather than assume they exist.

In the event of a breach

Should a breach affect your personal data, we notify the CNIL within 72 hours as required by the GDPR, and we inform you directly where the breach is likely to result in a high risk to your rights — telling you what happened, what was affected, and what to do about it.