Security

How we protect your account and your customers

What StartupAid does to keep accounts, keys, customer data and the people in your videos safe, what you can do on your side, and how to tell us about a problem.

Signing in

  • Passwords are stored only as a one-way hash (bcrypt). Nobody at StartupAid can read yours.
  • Two-factor sign-in with an authenticator app, plus single-use backup codes. A code works once, and repeated wrong codes lock further tries for a while.
  • Every device you are signed in on is listed in your account. You can sign any of them out, or all the others at once, and signing out ends that session on our side straight away.
  • You can also sign in with Google or GitHub.

Teams and roles

  • Invite teammates as admins or members. Each person signs in as themselves; nobody shares a password.
  • Only the owner and admins can buy or change a plan, create or revoke API keys, send credit gifts, or connect an outside app.
  • When someone is removed from a workspace, the API keys they created stop working with their access.

API keys and connected apps

  • A key is shown once, when it is created. We keep only a hash of it, so it cannot be read back later, by you or by us.
  • Keys can be revoked at any time and stop working immediately.
  • Connecting an AI assistant asks for your approval on a consent screen first, and creates a key you can see and revoke like any other.
  • Webhooks we send you are signed, so your server can check they came from us.

Your data

  • Everything between your browser or your servers and StartupAid travels over HTTPS.
  • Each account's data is kept apart: every request is checked against the account it belongs to.
  • The credentials you give us for social channels, push notifications and email signing are encrypted before they are stored.
  • Voice samples recorded for consent are kept privately, not in public file storage.

Payments

  • Card payments are taken by Stripe and Paystack. Card numbers never reach our servers and we do not store them.
  • Every payment notice from a payment provider is verified before anything is added to an account.
  • AI credits are only spent on work that is made. A render that fails is refunded in full.

Email you send through us

  • Mail is signed for your own domain (DKIM) once you publish the records we give you.
  • Marketing email carries a one-click unsubscribe, and people who unsubscribe, bounce or complain are not mailed again.
  • If bounces or complaints climb too high, marketing sends pause and you are told why, before your domain's reputation is damaged.
  • Lists can require double opt-in, so nobody is added without confirming.

People in AI video and voice

  • An avatar of a real person needs that person's consent, confirmed when the avatar is created.
  • A cloned voice needs a recording that begins with a spoken consent line. We listen for that line and refuse the recording without it.
  • A voice or avatar made in one account cannot be used from another.
  • What you type and upload for an AI feature is sent to the AI model provider that makes the result. A list of the providers we use is available on request.

Our own access

  • Staff actions on customer accounts are recorded in an audit log: who did what, to which account, and when.
  • There is no tool for staff to sign in as a customer.
  • Sign-up, sign-in and the public forms are rate-limited, and sign-up is checked for bots.

What you can do

Most account break-ins start with a reused password or a leaked key. These five habits close both doors.

  • Turn on two-factor sign-in for every person on your team.
  • Give each teammate their own login, and make them a member unless they need to manage billing or keys.
  • Keep API keys on your servers. Never put one in a web page or a mobile app.
  • Use a separate key for each system, and revoke a key the moment it is no longer needed.
  • Check the list of signed-in devices now and then, and sign out any you do not recognise.

Report a security problem

If you have found a weakness in StartupAid, or think your account has been misused, tell us through the contact page and start your message with the word Security. Say what you saw and how to reproduce it. Please give us a chance to fix it before sharing it with anyone else.

We reply to every report, and we will not take action against anyone who reports a problem in good faith.

Contact usPrivacy policyAPI status

StartupAid has not yet been through an independent security certification such as SOC 2 or ISO 27001. If your organisation needs answers to a security questionnaire, contact us and we will answer it directly.