Security

• Every project row is protected by database-level access rules tied to the signed-in account.
• Server-side checks validate project ownership before any read, generation or export.
• Administrative capabilities are role-based and separate from ordinary accounts.

• Traffic is encrypted in transit; stored files and database contents are encrypted at rest by our providers.
• Uploaded references and generated artwork are served through scoped, access-checked routes.
• Secrets and API keys are held server-side and never exposed to the browser.

• Managed database backups run on our provider's standard schedule.
• Approved artwork and published episodes are preserved through failed regenerations.

Report suspected vulnerabilities to security@steemy.com. Please give us reasonable time to investigate before public disclosure, and do not access other people's data while testing.