Security
Security & data protection.
VidMints is a small, focused team, and we take the security of your account and your work seriously. This page is a plain-language overview of the measures that protect your data. It complements — and does not replace — our Privacy Policy, which is the authoritative source on what we collect and your rights over it.
Encryption
- In transit — every connection to VidMints is served over HTTPS/TLS. Traffic between your browser, our API, and our storage and model providers is encrypted, so data can't be read in transit.
- At rest — your uploads and generated files are stored in cloud object storage that encrypts data at rest, and account records live in a managed database with encryption enabled.
Accounts & authentication
- Passwords are stored only as salted one-way hashes — we never store or can see your plain-text password.
- Sign-in uses short-lived session tokens with refresh cookies, so a leaked session expires quickly.
- You can also sign in with Google, so your credentials are handled by Google rather than typed into us.
- Email verification and password reset run over one-time, time-limited links.
Payments
We never handle raw card data ourselves. Checkout is processed by established, PCI-DSS-compliant payment providers on their own secure pages:
- Paystack — used for payments in Nigeria and local currency.
- Flutterwave — used for international and card payments.
Your card number, CVV and PIN are entered on the provider's checkout and never touch our servers. We only store the transaction reference and amount needed to apply your plan or credits and to support you if something goes wrong.
Storage & infrastructure
- Media is stored in Cloudflare R2 object storage. Files in your library are private to your account and served through expiring, signed URLs rather than being publicly listable.
- AI generation runs on trusted managed model providers; uploads are sent to them only to perform the compute you triggered, and are not used to train their general models on your behalf.
- Our application traffic sits behind Cloudflare, which provides TLS termination and protection against common web and denial-of-service attacks.
Access & data minimisation
- Access to production systems is limited to the people who need it to operate the service.
- We collect only what we need to run VidMints, and we do not sell your data or use it for ad targeting.
- You can export or delete your personal data at any time — see the Privacy Policy for how.
Reporting a vulnerability
If you discover a security issue, we want to hear about it. Please email security@vidmints.com with enough detail to reproduce it, and give us a reasonable chance to fix it before disclosing it publicly. We investigate every report and will keep you updated. Please don't run automated scans or tests that could degrade the service or affect other users' data.
A note on honesty: VidMints is an early-stage product. We describe the safeguards we actually operate above and deliberately make no claims to formal certifications (such as SOC 2 or ISO 27001) that we have not completed. As we grow, we'll update this page.