Security

ImagineMonster is a studio for making pictures, video, sound and 3D models with AI. People hand us prompts, reference photos, voice scripts and finished work, and pay for credits with a card. We treat all of that as sensitive and run a layered security programme to keep it private and intact.

This document describes the measures we apply across the website, the API behind it and the systems that store your files. It applies to every person and every system with access to ImagineMonster data: staff, contractors and the service providers we rely on.

Purpose and scope. These are the minimum requirements for the platform, its infrastructure and its handling of data. Where a law, a regulator or a contract requires more, the stricter requirement applies.

Encryption is the foundation of how we protect data, in transit and at rest.

• Every connection between your browser and ImagineMonster uses TLS. Plain HTTP is redirected, and cookies that carry a session are marked secure and are not readable by scripts.
• Passwords are never stored. We keep only a salted hash produced with a memory-hard algorithm, so a password cannot be recovered from our records, including by us.
• Sign-in sessions use long random tokens. The token itself is not stored; only a one-way hash of it is, so a copy of the database does not yield working sessions.
• Secrets we hold on your behalf, such as configuration credentials, are encrypted with AES-256-GCM under a key that lives outside the database.
• Database access is authenticated, restricted to the application's own network, and every query is built with typed drivers rather than string concatenation, which rules out injection.

Only you should be able to get into your account, and only staff who need to should be able to reach the systems behind it.

• Accounts sign in with an email address and password, or through a trusted identity provider. Passwords must meet minimum length and variety rules, and sign-in attempts are rate-limited to slow down guessing.
• Sessions expire on their own: a normal sign-in ends after a day, and a remembered sign-in ends after thirty days of not being used. Signing out invalidates the session on the server, not only in the browser.
• Password resets use single-use, time-limited links. Changing a password or a sign-in method ends every other active session.
• Requests that change anything must come from ImagineMonster's own pages: the server checks the request's origin and rejects cross-site submissions, which protects you from forged requests.
• Administrative features are limited to a small number of named accounts, and every administrative action runs through the same authenticated, audited API as everything else.

Identity verification. Sign-ups are confirmed through the email address or identity provider used to create the account. Changes that affect the security of an account, such as a new password, require the current password or a verified email link.

Access review. Staff and administrator roles are reviewed periodically and follow the principle of least privilege: each role has access only to what its work requires.

Payments are handled by an established, PCI DSS compliant payment processor on pages it hosts. Your card number and security code are entered there and never pass through ImagineMonster's servers.

• We receive and keep only what we need to run your account: the amount, the currency, the outcome, the plan, and the processor's reference for the transaction.
• Every payment notification the processor sends us carries a signature that we verify before acting on it. Notifications are also de-duplicated, so a repeated message can never grant credits twice.
• Credits are added and removed with single, atomic database operations, so two requests arriving at the same moment cannot spend the same credit twice or take a balance below zero.
• Refunds and disputes are reconciled automatically: when the processor reverses a payment, the credits it bought are removed.

Third-party provider oversight. We assess the security posture and compliance status of every payment provider before we integrate it, and we review that assessment periodically.

The files you upload and the results we make for you are stored under access controls that tie every file to the account that owns it.

• Every uploaded file is checked against its real contents, not its name or declared type, and files that are not the images or videos they claim to be are rejected. Oversized files are refused before they are stored.
• Your uploads and your creations can be fetched only through authenticated requests from your own account or by an administrator. A creation becomes visible to others only if you publish it to the community gallery yourself.
• Prompts, reference files and inputs are sent to the AI models that generate your results. Those models run on infrastructure operated by our model providers under contractual confidentiality and security obligations, and we send only what the generation needs.
• Vector files produced by our tools are sanitised before they are stored: scripts, external references and event handlers are stripped, so a downloaded file cannot execute anything.
• Generated content passes through the safety systems of the models we use. Prompts that those systems decline are not generated, and we tell you so rather than charging you.

ImagineMonster runs on hardened servers with redundant systems and regular backups.

• Firewalls and network rules limit which systems can reach the database and file storage. Nothing in the data layer is reachable from the public internet.
• Rate limits protect every public endpoint, including sign-in, sign-up, password reset, uploads and generation requests, so abusive traffic cannot exhaust the service for everyone else.
• Monitoring and alerting watch for unusual activity, failed jobs and error spikes, and we investigate what they raise.
• Regular security reviews and penetration testing look for vulnerabilities before anyone else does. Findings are tracked to closure.
• Disaster recovery plans exist for the loss of a server, a region or a provider, and they are tested.

We keep the software we run current. Dependencies, runtimes and operating systems are patched promptly, and we follow the security advisories of the vendors and projects we depend on.

Our engineers follow secure coding practices, changes are reviewed before they ship, and an automated test suite exercises the security-relevant paths of the platform, including authentication, payment handling, credit accounting and access to private files, on every change.

Vulnerability disclosure. If you believe you have found a security issue in ImagineMonster, please tell us at support@imaginemonster.art with enough detail to reproduce it. We acknowledge reports, investigate them promptly, keep you informed, and do not pursue researchers who act in good faith and give us reasonable time to fix what they found.

Account data and your creations are backed up automatically on a regular schedule. Backups are encrypted and kept in more than one location.

• Backup restores are tested regularly so that we know they work before we need them.
• Backups are kept for a limited, defined period and then destroyed, so deleted data does not linger indefinitely.
• If data is lost or corrupted, documented recovery procedures restore it as quickly as possible.

Our measures protect the platform, but the safety of your own account also depends on you.

• Use a strong password that you use nowhere else. A password manager makes this easy.
• Never share your sign-in details. One account is for one person.
• Keep your browser, operating system and devices up to date.
• Be wary of messages asking for your password or payment details. We never ask for your password by email, and payments only ever happen on our payment processor's pages.
• Sign out on shared computers, and use the settings page to end other sessions if you think one is not yours.
• If you notice anything suspicious about your account, contact us straight away at support@imaginemonster.art.

Review and updates. This policy is reviewed periodically and updated as technology, regulations and good practice change. The current version is always the one published here.

Enforcement. Compliance with this policy is mandatory for everyone with access to ImagineMonster systems or data. Violations lead to disciplinary action, up to and including the end of access or employment, and are reported to the authorities where the law requires it.

Approval and exceptions. This policy is approved by ImagineMonster's designated security authority. Any exception must be requested in writing with a justification, a risk assessment and compensating controls; approved exceptions are time-limited and reviewed.

Questions about this policy, and reports of suspected vulnerabilities, go to support@imaginemonster.art.