1. Account and access controls
Account authentication and scoped data-access rules protect private account records. Ordinary Library reads explicitly select the signed-in owner's songs. Privileged administration checks protected roles; role management and financial adjustments use audited operations. Administrators cannot view account passwords.
Profile-photo uploads are validated against owner-specific storage paths. Private media uses expiring signed display/playback links. A signed link can be used by anyone who possesses it until expiry; do not treat it as copy protection or an absolute guarantee of confidentiality. Community playback intentionally gives other users access to eligible songs.
2. Payments, secrets and API credentials
Stripe hosts payment collection. Paid values are calculated on the server rather than trusted from browser requests. Payment fulfillment verifies webhook signatures and uses transaction records to reduce duplicate grants. Credit ledgers separate generation credits from seller cash earnings.
Account API keys are stored as SHA-256 hashes with scope, expiry and revocation records; raw keys are shown when created. Server credentials are not intended to be exposed in browser application code. Restrictions and security checks can deny checkout. These measures do not establish that every endpoint has universal rate limiting or that no vulnerability can occur.
3. Limits and shared responsibility
The public service uses HTTPS. We do not claim end-to-end encryption: the application and relevant AI providers must process submitted content. We do not claim an independently audited certification, verified encryption-at-rest configuration, guaranteed region, uninterrupted service or 100% security.
Choose a unique password, secure your email account and device, keep private keys out of prompts, and use only the official site and payment pages. Do not include medical records, identity documents or sensitive children's information in generation requests. Back up important files you are permitted to retain.
4. Report a concern responsibly
Email support@muziq.co with the subject ‘Security report.’ Include the affected page, a minimal reproduction, approximate time and potential impact. Do not include passwords, access tokens, full card numbers or other users' private content. Ask us for a secure transfer method if evidence contains sensitive information.
Only test systems and accounts you are authorized to use. Do not access other users' data, disrupt services, make real fraudulent payments or publish exploit details before reasonable coordination. This policy does not grant blanket penetration-testing permission, legal safe harbor or a bounty. We assess reports and coordinate appropriate remediation; no fixed response or remediation deadline is promised.
5. Incidents and notifications
When a security incident is identified, we assess impact, contain it, preserve necessary evidence and determine notifications and remedial steps under applicable law. Notification decisions depend on the facts and legal obligations; we do not promise an unverified detection or notification time. Privacy requests and data handling are described in the Privacy policy.