Is my data secure? How is my information protected?

Overview

GRYYD implements enterprise-grade security measures to protect your account data, uploaded product photos, generated images, and payment information. We comply with industry-standard security protocols (SOC 2, GDPR, PCI DSS for payments) and employ multiple layers of defense—encryption at rest and in transit, role-based access controls, regular security audits, and automated threat detection. This FAQ details our security architecture, data handling practices, and your privacy rights.

Data Encryption & Storage

Encryption Standards:

• In Transit: All data transmitted between your browser and GRYYD servers uses TLS 1.3 encryption (HTTPS)—same security as online banking
• At Rest: Uploaded images and generated files stored on servers use AES-256 encryption—military-grade standard
• Backups: Encrypted backups stored in geographically distributed data centers (automatic redundancy)

Storage Infrastructure:

• Cloud storage on AWS S3 (Amazon Web Services) with 99.99% uptime SLA
• Images stored in private buckets—not publicly accessible via direct URLs
• Access requires authenticated API requests with valid session tokens

Data Retention Policy:

• Active projects: Stored indefinitely while your account is active
• Deleted projects: Permanently purged from all servers within 30 days of deletion
• Account deletion: All associated data deleted within 90 days (includes backups)

Account Security

Authentication & Access Control:

• Secure password hashing with industry-standard algorithms
• Social login via OAuth 2.0 (Google, Facebook)—GRYYD never sees your social media password
• Session-based authentication with automatic timeouts for security
• Password change available in Settings > Security (email/password accounts)

Best Practices for Users: \`\`\` ✅ Use strong, unique passwords (minimum 10 characters, uppercase + special character required) ✅ Change passwords regularly and avoid reusing old passwords ✅ Log out on shared/public computers ✅ Use password managers (1Password, Bitwarden) to generate secure passwords \`\`\`

Payment Security

Payment Processing:

• All payment transactions processed via Stripe (PCI DSS Level 1 certified)
• GRYYD never stores your full credit card number, CVV, or banking details
• Stripe tokenization: Only encrypted payment tokens stored on GRYYD servers
• 3D Secure (3DS) authentication for fraud prevention on supported cards

Billing Transparency:

• View all transaction history in Settings > Billing
• Download invoices for accounting/tax purposes
• One-click subscription cancellation (no hidden fees or retention tactics)

Privacy & Compliance

What We Collect:

• Account information: Email, display name, profile photo (optional)
• Usage data: Login timestamps, feature usage analytics (anonymized)
• Payment data: Billing address, transaction history (via Stripe)

What We Do NOT Collect:

• Your generated images are NOT used for AI model training
• We do NOT sell or share your data with third-party advertisers
• We do NOT track browsing behavior outside gryyd.ai domain

Compliance Standards:

• GDPR-compliant (EU data protection regulations)—you can request data export or deletion anytime
• CCPA-compliant (California privacy laws)—right to know, delete, and opt-out
• Regular third-party security audits and penetration testing

Pro Tip: Use a password manager (1Password, Bitwarden, LastPass) to generate and store unique passwords for GRYYD and other accounts. This dramatically reduces risk of account compromise.

See also: Account Deletion | Image Copyright | Browser Support | Privacy Policy