Security overview

Infrastructure

Äng runs on Vercel (hosting and edge network) and Supabase (database, authentication, and object storage). Both providers maintain SOC 2 compliance and support data residency in the EU.

• Vercel — HTTPS everywhere, DDoS protection, automatic TLS certificate renewal, and the Vercel AI Gateway for multi-provider model routing.
• Supabase— Postgres with row-level security (RLS) enabled. RLS and active board-membership checks ensure only invited members can reach a board's data, and that viewers cannot write. Finer-grained limits on what an editor or commenter may change are enforced in the application layer. Authentication uses Supabase Auth (OAuth via Google, magic link email).

Authentication

Supported methods are Google OAuth and email magic link. Passwords are never stored. Sessions are maintained via short-lived JWTs refreshed on every request. Supabase sessions are rotated on the server side using the @supabase/ssr library so tokens are never exposed in the browser URL.

Content Security Policy

Every page response includes a strict Content Security Policy (CSP) with a per-request cryptographic nonce. This means:

• Only scripts explicitly injected by our server (carrying the correct nonce) can execute. Scripts from XSS attacks are blocked.
• unsafe-inline is not permitted for scripts.
• script-src includes blob: and wasm-unsafe-eval so the ONNX runtime can load blob worker bundles and compile WebAssembly for on-device background removal (narrower than unsafe-eval).
• connect-src is restricted to a known allowlist of domains (Supabase, Sentry, Vercel, PostHog, Cloudflare challenges, Pusher, Hugging Face Hub and jsDelivr for on-device background removal / ONNX runtime assets, and OpenAI for optional voice transcription), which limits outbound connection channels after a successful XSS.
• object-src 'none' — no plugins or embedded objects.

CSRF protection

All state-changing API requests (POST, PUT, PATCH, DELETE) are checked with same-origin Origin / Referer validation. Cross-site requests are rejected with HTTP 403 before reaching any handler. Cron, job-worker, Stripe webhook, and one-click unsubscribe endpoints use secret- or signature-based auth instead of browser cookies.

Data isolation

Row-level security in Supabase enforces that only active members of a board can reach its boards and assets, and that viewers cannot write. This membership gate is enforced at the database level. Finer-grained per-role limits on what a collaborator may change are enforced in the application layer.

AI and third-party processing

Most AI image, video, and text generation runs through the Vercel AI Gateway to a curated set of providers (Google, OpenAI, Anthropic, Microsoft, ByteDance). Reve and fal.ai (image-to-3D) are called via direct API integrations. When you generate or edit, the relevant prompt and media are sent to the provider that powers the model you selected, under that provider's terms.

Äng does not use your content to train its own models or share it for advertising. New accounts default to Zero Data Retention (ZDR) in Settings → AI, which limits the catalog to ZDR-compatible models. You can switch to No training or Standard for a broader catalog; Standard may allow providers to use inputs to improve their models per their own policies. See the privacy policy and subprocessors for details.

Error monitoring

Äng uses Sentry for error monitoring (EU – Frankfurt). Session replays are only recorded when an error occurs; all text is masked and all images are blocked in replays. See the privacy policy for full details.

Responsible disclosure

If you discover a security vulnerability, please report it using the in-app feedback form or email privacy@ang.studio. We will acknowledge reports within 48 hours and aim to resolve confirmed issues promptly. We ask that you give us reasonable time to address the issue before public disclosure.