SECURITY & TRUST

Built to sit in your production pipeline

The render endpoint is infrastructure your site depends on. Here's exactly how authentication, API keys, rendered assets, and webhooks are handled — no vague reassurances, the actual mechanisms.

Read the developer docs

Rendered assets stay private

Generated OG images and uploaded assets live in a private S3 bucket — CloudFront's Origin Access Control is the only reader. There's no direct, publicly-guessable S3 URL anywhere in the product; every image is served through the render pipeline or CDN.

Auth via Clerk, workspaces via Organizations

Sign-in and session management run on Clerk, not a hand-rolled auth system. Workspaces map directly onto Clerk Organizations — no parallel permissions model to keep in sync or get out of sync.

API keys are hashed, never stored in plaintext

A generated API key's plaintext is shown exactly once, at creation. From then on, only its SHA-256 hash is stored — even a full database read can't recover a usable key. Revoke a key any time from Settings > API keys; it stops authenticating immediately.

Every webhook is signature-verified

Inbound webhooks — Clerk user/org events, Dodo Payments billing events — are verified against their signature before anything is processed. An unsigned or mis-signed payload is rejected before it touches your data.

DATA HANDLING

What's stored, and where

Workspace & product data

Projects, templates, sharing links, audit findings, and usage counters are stored in Convex, scoped by workspace. Every query and mutation checks workspace ownership before returning or changing data — an API key or session can only ever reach the workspace it belongs to.

Rendered images & uploaded assets

Convex stores object keys and metadata only, never image bytes. The bytes themselves live in a private S3 bucket, served exclusively through CloudFront with Origin Access Control — the bucket has no public read access.