Security | iZop

Data encryption

All data transmitted between your browser and iZop is encrypted using TLS 1.2 or higher. Data at rest is encrypted using AES-256 on Supabase-managed PostgreSQL infrastructure hosted on AWS. OAuth tokens (access tokens for your connected social accounts) are stored encrypted in the database.

Authentication

iZop uses Supabase Auth for user authentication. We support email OTP (one-time passcode) and Google OAuth. We never store plaintext passwords. Sessions are managed with short-lived JWTs and rotate automatically.

Social account tokens

When you connect a social account, iZop stores only the OAuth access token required to perform actions on your behalf. We request the minimum required permissions for each platform. You can disconnect any account at any time from your Account page, which immediately revokes our access.

Payment security

iZop uses Stripe for all payment processing. We never store your credit card details. Stripe is PCI DSS Level 1 certified. All checkout flows use Stripe-hosted pages with TLS encryption. iZop only stores your Stripe customer ID and subscription status.

Media storage

Images and videos you upload in the Composer are stored in Cloudflare R2, a private S3-compatible object store. Files are served via signed URLs with short expiry times. No public access without a valid signed token.

Infrastructure

iZop AI is hosted on Vercel (serverless, globally edge-deployed, US-based). The database runs on Supabase (AWS ap-northeast-2, Seoul, South Korea). South Korea has received an EU adequacy decision, meaning data transfers from the EEA comply with GDPR. We use connection pooling, rate limiting, and environment variable isolation. No developer has direct production database access in normal operations. Media files (images, videos) are stored on Cloudflare R2 (US-based, globally distributed CDN).

Reporting a vulnerability

If you discover a security vulnerability, please report it by emailing support@izop.ai. We take all reports seriously and aim to respond within 48 hours. Please do not disclose the vulnerability publicly until we have had a chance to address it.