This page describes the technical and organisational measures we use to protect your account and your content. It is written to describe what actually exists, not what we would like to have; it complements the Privacy Policy and the Terms of Service.
1. Encryption
- In transit: all traffic between your browser and the platform is encrypted with TLS (1.2 or higher; TLS 1.3 on current browsers). We accept no unencrypted connections.
- At rest: your files, your results and the database are stored encrypted with AES-256 on Google Cloud; the keys are managed by the provider.
- Passwords: stored with a strong hashing algorithm and cannot be recovered; if you forget yours, a reset with a single-use link is started.
2. Infrastructure
Neexis Render runs on Google Cloud Platform, in the europe-west9 (Paris) region: your account, files and results are stored within the European Union.
- Private network with firewall rules that expose only what is needed; public traffic passes through Cloudflare's network, which filters attacks.
- Administrative access to servers is by SSH with keys, without passwords, and limited to the technical team.
- Changes to production come from the code repository and are recorded there.
3. Isolation between users
Your models, images and results are only accessible from your account. Every file download checks who is asking and whether they own it (or are a team member with access); without a session, private files are not served. File addresses are not guessable. Only the Neexis catalogue (library styles, materials and backgrounds) is public.
4. Identity and access control
- Sign in with a password, with a magic link by email or with Google.
- Sessions expire automatically and you can sign out of all devices from your account; changing your password also closes the other sessions.
- Sign-in attempts are rate-limited to stop brute-force attacks, and security events are logged for 90 days.
- Production credentials live outside the code, in configuration files with restricted permissions on the servers.
- The team accesses systems with named accounts and only what they need.
5. No AI training with your content
Neexis Render does not use your files or your results to train AI models, neither our own nor third parties'.
When we process content through generative model providers (Google, fal.ai and Scenario) we do so only to obtain the result and we authorise none of them to use it for training. On Scenario we also delete the files as soon as the generation finishes. What each provider keeps and under which safeguards is detailed, provider by provider, in section 4 of the Privacy Policy.
6. Backups and recovery
- An encrypted copy of the database every day, stored in a different region from the data (europe-west1), in an append-only store: backups cannot be deleted or overwritten from the servers.
- Daily copies are kept for 35 days and a monthly copy is kept for 5 years.
- Your files and results are stored on Google Cloud Storage with the provider's redundancy.
- Backups have been restored in test environments to verify that the procedure works.
7. Monitoring
- Platform and editor errors are logged in a monitoring system we host ourselves, and alerts reach the team in real time.
- Automatic checks of availability and that media is being served correctly.
- Security events (sign-ins, failed attempts, password changes) are logged.
8. Payments
Payments are processed by Stripe. Your full card details never pass through Neexis Render's servers: they go directly to Stripe (PCI-DSS) from your browser.
9. Incident management
If a security incident occurs that may affect your data:
- We contain it, investigate it and fix it.
- If it poses a risk to your rights, we notify the Spanish Data Protection Agency within 72 hours (art. 33 GDPR).
- We inform the people affected without undue delay where applicable (art. 34 GDPR).
10. Responsible disclosure
If you discover a vulnerability in Neexis Render, please report it to us privately before making it public, so that we can fix it without putting other users at risk.
Channel: hola@neexisrender.com with the subject "Security report". We will reply within a reasonable time and we sincerely appreciate the help.
11. Regulations
- GDPR (Regulation (EU) 2016/679): how we process your data is in the Privacy Policy.
- LOPDGDD (Spanish Organic Law 3/2018).
- LSSI (Spanish Law 34/2002 on information society services and e-commerce).
- Our main providers (Google Cloud, Stripe, Cloudflare) hold security certifications such as ISO 27001; Neexis Render currently holds no certifications of its own.
12. Contact
For any question or security report: hola@neexisrender.com.
This page is originally written in Spanish. In case of divergence between language versions, the Spanish version prevails.