Skip to content
Hiroi Presents Beta
Sign in Start free
Features Pricing Sign in Start free
Hiroi Presents

Security & Trust

How we protect your account and your content. This overview describes the security controls we operate; our practices are aligned to the SOC 2 Trust Services Criteria (Security, Availability and Confidentiality).

Our commitment

Security is built into Hiroi Presents, not bolted on. We follow the principle of least privilege, defence in depth, and secure-by-default configuration. The controls below are the same ones running in production today — many are visible to you directly on your account security page.

Encryption

  • In transit. All traffic is served over HTTPS/TLS. We send HTTP Strict Transport Security (HSTS) so browsers refuse to connect over plaintext.
  • At rest. Your data is stored in Microsoft Azure SQL, encrypted at rest with Transparent Data Encryption. Backups are encrypted with the same protection.

Access control & authentication

  • Passwordless sign-in. We authenticate with single-use, short-lived magic links and emailed one-time codes — there is no reusable password to phish, leak or reuse. Tokens are stored hashed and expire quickly.
  • Brute-force protection. Sign-in is rate-limited; repeated failures are throttled per account and per IP, with anti-enumeration responses that never reveal whether an email exists.
  • Session hardening. Sessions use signed, HttpOnly, Secure, SameSite cookies, are bound to your credentials, and expire automatically. Deactivating your account signs you out everywhere.
  • Least privilege. Each user can only access their own decks and data; ownership is enforced on every read and write. API keys are scoped and can be revoked instantly.

Application security

  • A strict Content-Security-Policy, plus anti-clickjacking (X-Frame-Options / frame-ancestors), MIME-sniffing protection (X-Content-Type-Options), a locked-down Permissions-Policy, and a tight referrer policy on every response.
  • CSRF protection on browser-driven forms; input is validated and output is escaped. Uploaded images are verified by content (magic bytes), not file extension.
  • Outbound URL fetching is SSRF-hardened (scheme/port allowlisting, DNS re-validation at connect time) so the service can't be tricked into reaching internal resources.
  • API keys are never stored in plaintext — only a PBKDF2 hash and a short display prefix are kept, and verification is constant-time.

Audit logging & monitoring

Security-relevant events — sign-in, sign-out, failed sign-in, sharing, API-key lifecycle, deck deletion, data export and account changes — are recorded to a structured, append-only audit trail with the actor, source IP, timestamp and outcome. Logs are centralised for retention, alerting and investigation.

Payments

Billing is handled by Stripe, a PCI-DSS Level 1 service provider. We never see or store your card details — payment data goes directly to Stripe.

Infrastructure & availability

Hiroi Presents runs on Microsoft Azure. Compute runs behind a managed ingress with automated TLS, and credentials are supplied through managed identity and secret stores rather than embedded in code. Configuration enforces production safeguards (for example, the application refuses to run destructive operations against the production database).

Your data & privacy

  • Export. You can download a complete copy of your data (profile, decks, API-key metadata, billing history) at any time from your account security page.
  • Deletion. You can deactivate your account from the same page; this immediately disables sign-in and revokes active sessions. Contact us to request permanent deletion.
  • Subprocessors. We rely on a small set of vetted providers: Microsoft Azure (hosting & database), Stripe (payments), and email/voice providers used to deliver sign-in messages and narration.

Reporting a vulnerability

We welcome reports from security researchers. Please email security@hiroi.ai with details and steps to reproduce; our machine-readable policy is published at /.well-known/security.txt. Please give us a reasonable time to remediate before public disclosure, and avoid privacy violations, service degradation, or data destruction while testing. We will not pursue good-faith research conducted under these guidelines.