Security | Rewind.ai

Yes. Traffic between your browser and Rewind.ai uses HTTPS over TLS 1.2 or newer, and the API calls to our GPU inference servers are encrypted the same way. HSTS is enforced to block downgrade attacks.

No. We don't use your inputs, outputs or uploaded files to train AI models, on free, paid and enterprise accounts alike.

Payments are processed by Square, our payment processor, whose card processing systems meet Level 1 PCI Data Security Standards. Your card number, CVV and full card details never reach our servers.

Yes. Every self-hosted model is open-source under a permissive license (Apache 2.0 or MIT). The weights, architecture and training method are published on HuggingFace and GitHub for anyone to review.

No. We do not sell, rent or share your personal data with third parties for advertising or marketing. This is a firm policy with no exceptions.

They use SSH key-only access with no password login, apply security updates automatically, restrict traffic to only the ports we need with firewall rules, and keep database backups encrypted. We follow standard security practices across all infrastructure.

Files you upload are processed for the task you asked for and saved with the run in your history. We don't sell them or use them to train models, and we delete them on request.

We operate on GDPR principles: data minimization, purpose limitation and the right to deletion. Reach out if you need a Data Processing Agreement (DPA).

We watch for vulnerabilities continuously and patch them quickly. If you find a security issue, report it through the contact form. We take every report seriously and respond fast.

API keys are hashed before they are stored and only ever sent over HTTPS. You can revoke a key and create a new one at any time from the API Keys tab of your account. We suggest rotating keys regularly and never sharing them publicly.