Security and privacy
What is protected, how, and what is not.
| Layer | Implementation |
|---|---|
| Sign-in | Thundera SSO; the API verifies the thundera_token cookie or a Bearer token |
| Originals | AES-256-GCM at rest (nonce + ciphertext); key held by the service |
| Thumbnails | Not encrypted; served through short-lived presigned URLs |
| Rate limiting | 100 requests/min per IP (Redis-backed) |
| Headers | HSTS, CSP, X-Frame-Options, X-Content-Type-Options |
| Admin | System roles from the SSO token (or an admin API key for automation) |
Not end-to-end
Encryption is at rest with a service-held key. The service can decrypt originals to serve them to you; it does not look at them for any other purpose and never trains models on them.
Sharing links are unguessable tokens; add a password, expiry or view limit for anything sensitive.