Security

Email security@castgenx.com with what you found, steps to reproduce it, and the impact you expect. We acknowledge reports within 3 business days, keep you updated, and tell you when it is fixed. [OWNER: confirm the security@ mailbox exists]

When you test, please:

• use only your own accounts and data, and stop as soon as you reach someone else's data;
• do not run denial-of-service, spam or social-engineering tests, or test our providers' systems (report those to them);
• give us reasonable time to fix the issue before you disclose it.

If you follow these rules in good faith we will not pursue legal action against you for your research, and we will thank you publicly if you wish. We do not run a paid bug bounty at the moment. Our security.txt has the same contact.

• Encryption: everything travels over HTTPS. Provider keys and YouTube tokens you save are encrypted with AES-256-GCM, and API keys, private-feed links and guest links are stored only as hashes.
• Sign-in: handled by Clerk, with support for social sign-in and verified email. Deleting your account requires a fresh sign-in.
• Access: every request is checked against the owner or workspace. Your cloned voice can only be used by you. Private files are served through short-lived signed links, and private feeds through per-listener links you can revoke.
• Infrastructure: the app, database and files run on our own server; internal services are not exposed to the internet; containers run without root privileges.
• Abuse protection: rate limits and quotas per plan, webhook signature checks and strict input limits.
• Less data, fewer places: each AI provider gets only what its step needs, with model training turned off where possible. Browser analytics and error reports run only if you allow them.
• Software supply chain: automated tests, dependency audits and pinned dependencies in every build.
• Backups: [OWNER: describe off-site encrypted backups once in place].

We monitor for errors and security events. If a breach affects your personal data, we will tell you without undue delay and, where the law requires, notify the authorities. Business customers are notified within 72 hours under the data processing addendum.

• Use a strong, unique password or social sign-in.
• Keep API keys secret and revoke any you no longer use (Settings → Developer API).
• Revoke private-feed and guest links you no longer need, and remove teammates who have left.