At Morphed, protecting your data is a top priority. This Security Policy outlines the organizational and technical safeguards we implement to prevent unauthorized access, use, alteration, or disclosure of your data. We encourage reviewing our Terms of Service and Privacy Policy for additional details.
1. Infrastructure & Hosting
Morphed operates entirely on cloud-based infrastructure. We do not operate physical servers or hardware. Our infrastructure is hosted by industry-leading providers:
- Application Hosting: Vercel for frontend deployment with global edge network
- Cloud Storage: Encrypted cloud storage for user content and generated assets
- Database: Managed database services with automated backups and point-in-time recovery
- AI Processing: Dedicated GPU infrastructure with isolated processing environments
2. Encryption
Data in Transit: 100% HTTPS service delivery. All data transmissions are encrypted using industry-standard TLS 1.3 with 256-bit encryption.
Data at Rest: Sensitive data is encrypted using AES-256 encryption standards. This includes user uploads, generated content, and account credentials.
Payment Data: All payment transactions are processed securely through Stripe. We never store full credit card numbers on our servers.
3. Access Controls
- Mandatory two-factor authentication (2FA) for all internal systems and infrastructure access
- Strong password policies enforced across all platforms and services
- Role-based access control (RBAC) with least-privilege principles
- Regular access reviews and prompt deprovisioning of departed team members
- Dedicated secrets management for API keys, credentials, and certificates
4. Data Isolation & Privacy
Customer data is stored in multi-tenant environments with strict logical separation enforced by application-level privacy controls. Each user's data is isolated and accessible only to the account owner.
AI generation requests are processed in ephemeral, sandboxed environments. Input images and prompts are not shared between users or sessions.
5. Incident Response
- Established formal procedures for security events with documented response plans
- Immediate escalation and team assembly for security incidents
- Affected users are notified within 72 hours of a confirmed data breach, as required by GDPR and applicable laws
- Detailed post-mortem analyses following each incident with corrective actions
6. Monitoring & Logging
- Continuous monitoring of infrastructure and application health
- Centralized logging with retention for audit and forensic analysis
- Automated alerting for anomalous behavior or potential security threats
- Regular vulnerability scanning and dependency auditing
7. Secure Development Practices
- Code reviews are required for all changes before deployment
- Automated security scanning in the CI/CD pipeline
- Dependency vulnerability monitoring with automated remediation
- Separation of development, staging, and production environments
- Security training for all engineering team members
8. Compliance & Standards
Our security practices align with:
- GDPR: Full compliance with the European General Data Protection Regulation
- CCPA: Compliance with the California Consumer Privacy Act
- SOC 2: We follow SOC 2 principles for security, availability, and confidentiality
- OWASP: Our development practices follow OWASP Top 10 security guidelines
9. Your Responsibilities
Security is a shared responsibility. We ask you to:
- Use strong, unique passwords for your account
- Enable two-factor authentication when available
- Keep your credentials confidential and do not share your account
- Notify us immediately at security@morphed.ai if you suspect unauthorized access
- Comply with our Terms of Service and applicable laws
10. Vulnerability Reporting
If you discover a security vulnerability in our Services, please report it responsibly:
- Email: security@morphed.ai
We appreciate responsible disclosure and will work with you to address verified vulnerabilities promptly. We will not take legal action against good-faith security researchers who follow responsible disclosure practices.
11. Contact Us
If you have questions about our security practices, please contact us:
- Security Team: security@morphed.ai
- General: legal@morphed.ai