Security overview

Where your data is stored

• Boards, files and account data: Supabase, Stockholm, Sweden. Postgres database, sign-in and file storage, encrypted at rest by Supabase.
• Application servers: Vercel, Stockholm, Sweden. Pages and static files are delivered through Vercel’s global edge network, which also provides DDoS and bot protection.
• Off-site copy of stored files: Cloudflare, EU. Protected against deletion for 30 days and deleted after 90. Daily database backups stay in Stockholm with Supabase.
• Error monitoring: Sentry, Frankfurt, Germany. Session replays are recorded only when an error occurs, with all text masked and all images blocked.
• Product analytics, only after consent: PostHog, Frankfurt, Germany.
• Rate limiting: Upstash, Ireland.
• Email delivery: Resend, Ireland (sending). Emails are sent from Ireland; Resend is a US company.

Outside the EU

• AI models, depending on the model or feature you use, including board agent chat and the automatic analysis of your images for search (Google, OpenAI, Anthropic, fal.ai)
• Google sign-in (Google)
• Payments (Stripe)
• In-app feedback (Notion)

This is not the full list. Every provider, what it receives and where it is located is on the subprocessors page.

How your data is protected

• Encrypted in transit: All traffic uses HTTPS/TLS. HTTP is redirected to HTTPS and the production site serves HSTS, so browsers refuse cleartext connections. Stored files are private and served through short-lived signed links.
• Only board members: Row-level security in the database lets only active members of a board reach its content, and viewers cannot write.
• No passwords to steal: Sign-in is Google or an emailed magic link; passwords are never stored. Sessions use short-lived tokens that never appear in the browser URL. In-app administrator access requires two-factor authentication.
• Locked-down pages: A strict Content Security Policy with a per-request nonce lets only scripts our server sends run. State-changing requests from other sites are rejected before they reach any handler; server-to-server endpoints authenticate with secrets or signatures instead.

AI and your content

When you generate or edit, the prompt and media for that job are sent to the provider that runs the model you chose. The connection is encrypted, but this is not end-to-end encryption: the provider has to process the content to run the model. Äng never uses your content to train its own models or for advertising.

You choose how strict this is in Settings → AI:

• No training (the default): Only models offered on terms that exclude training on your inputs and outputs.
• Zero Data Retention: Stricter: only models offered with zero data retention. A job that no such provider can run is refused.
• Standard: The full catalog, including features that call fal.ai directly. Providers may use inputs to improve their models under their own policies.

See the privacy policy and subprocessors for details.

How we work

• Security rules, such as authorization on every API route, are enforced in code and checked by automated tests before every release.
• Dependencies are checked for known vulnerabilities every day, and urgent fixes are prioritized.
• Data is backed up daily, and restoring from backup has been tested.

Responsible disclosure

If you discover a security vulnerability, please report it using the in-app feedback form or email privacy@ang.studio. We aim to acknowledge reports quickly and to resolve confirmed issues promptly. We ask that you give us reasonable time to address the issue before public disclosure. Contact details are also published in security.txt.

One-page summary

A printable summary of this page for your security or procurement review is at Security at a glance. Last reviewed 2026-10-27.