Security

Updated: 2 November 2026

What we do

Keys. An API key is shown once when you create it. We store only a hash, so a lost key cannot be shown again and a database leak does not reveal your keys. You can set scopes and a monthly budget on each key and revoke it at any time.
In transit. All traffic to the site and the API uses HTTPS.
Files. Uploads and results are kept in private storage with server-side encryption. Links to them are signed and expire. Uploads are checked against the file's real type, and size limits are enforced.
Your content stays yours. We do not train models on your prompts, files or results.
Isolation. Each account can read only its own requests, files, keys and logs.
Limits and monitoring. Requests are rate limited. We watch for abuse and for unusual spend on a key, and we keep error reports free of prompts, file contents and keys.
Access. Staff access to production is limited to people who need it.
Providers. We pass a model provider only what a request needs, and not your name or email. See Sub-processors.

Keep API keys in environment variables or a secrets manager. Never put them in browser code or a public repository.
Use a separate key per project, and revoke the ones you no longer use.
Set a monthly budget on every key.
If a key leaks, revoke it on the API keys page and make a new one.

Email support@vidlab.ai with what you found, the steps to reproduce it, and how to reach you. Our contact details are also in security.txt.

We reply as fast as we can and keep you updated until it is fixed.
Please give us reasonable time to fix a problem before you share it.
Test only against your own account. Do not read other people's data, run denial of service tests, or use social engineering.
We will not take legal action against research that follows these rules and is done in good faith.

Our Data Processing Addendum and Sub-processors pages are public. For anything else, write to support@vidlab.ai.