Security is foundational to how we build Cretos. Here's a plain-language look at what's in place today, and what we're actively building next.
What's in place today
- Authenticated access — accounts are protected via our authentication provider, with email/password and social login options.
- Row-level data isolation — your content, AI memory, and account data are scoped at the database level so other users' data isn't accessible to you, and vice versa.
- Encrypted in transit — all traffic to Cretos is served over HTTPS.
- Rate limiting — our AI infrastructure enforces request limits to protect against abuse and keep the platform stable for everyone.
- Least-privilege access internally — administrative actions are restricted to authorized team members.
What we're actively building
- Multi-factor authentication — on our near-term roadmap for all account tiers.
- Structured audit logging — a complete record of administrative actions, to strengthen accountability as our team grows.
- Expanded security headers and hardening — ongoing work as part of every release.
Responsible disclosure
If you believe you've found a security issue, we want to hear about it before anyone else does. Please email support@cretos.ai with details — we take every report seriously and will respond promptly. Please don't publicly disclose a potential issue before giving us a reasonable chance to address it.
Related
See our Subprocessors page for who we work with, and our Compliance page for our data protection commitments.
