Security

Security at Reeloop

Last updated August 8, 2026

This page describes the concrete measures we take to protect your account and content. We do not hold a formal certification (SOC 2, ISO 27001) yet - rather than claim one, we list here what is actually in place, and we rely on certified infrastructure providers for the layers underneath.

Infrastructure & data protection

• Encryption in transit. All traffic is served over HTTPS with HSTS (including subdomains, preload enabled).
• Encryption at rest. The database and file storage are hosted on Supabase (AWS), which encrypts data at rest. Media is served from provider CDNs over TLS.
• Row-level security. Database access is enforced by Postgres row-level security policies, so one account can only ever read its own rows; server-side writes go through a scoped service role.
• Per-user API keys. Public API and MCP access use per-user keys (prefix fl_) scoped to your account, revocable individually.
• Secrets management. Provider credentials and OAuth tokens are stored as environment secrets, never in the codebase or client bundles; connected-account tokens are stored server-side only.

Application security

• Content Security Policy. A strict CSP, frame-ancestors, and other hardened headers limit what scripts and frames can run on the site.
• Abuse controls. Rate limiting and credit-reservation guards protect generation endpoints against abuse and race conditions.
• Failed-render refunds. A generation that fails on our side is automatically refunded, so an outage never silently consumes your balance.
• Consent-gated sensitive features. Voice cloning and face/avatar uploads require explicit consent and can be withdrawn at any time.

Sub-processors

We rely on a small set of infrastructure providers, each covered by its own security program and DPA. The full, current list of sub-processors (what each receives and its scope) is maintained on the sub-processors page.

Data retention & deletion

Data is kept on fixed schedules enforced by an automated daily job (for example, intermediate tool outputs are deleted after 30 days, source voiceovers 7 days after render). You can delete your account and all associated data at any time from Settings → Account. The full retention schedule is in the Privacy Policy.

Reporting a vulnerability

If you believe you have found a security issue, please email support@reeloop.ai with the details. We ask that you give us a reasonable window to investigate and fix before any public disclosure. We do not currently run a paid bug-bounty program.