Security and Data Protection
How we protect your data
- Encryption in transit: every connection uses HTTPS (TLS), served through Cloudflare.
- Storage: projects live in Cloudflare's database (D1), on Cloudflare's infrastructure.
- Sign-in: through GitHub or Google; we never store passwords. Sessions are signed, HTTP-only cookies.
- Payments: handled entirely by Dodo Payments; card details never reach our servers.
- Isolation: generated designs run in sandboxed frames that can't read your session or the rest of the app.
- Fraud-prevention signals are stored only as salted hashes.
- Server-side fetches (website theme import) refuse private network addresses.
Who can access it
- Staff access to the admin console needs a two-factor code, uses least-privilege roles, and expires after 8 hours.
- Sensitive actions (refunds, data exports, account deletion, large credit grants) need a fresh two-factor code, and large ones a second admin's approval.
- Every admin action needs a written reason and is recorded in an append-only audit log.
- The admin console shows account, billing and usage records, never your project contents.
Your controls
- Share links can be private, view-only or editable, and you can revoke them at any time.
- Download your data or delete your account from Billing & Usage (see the Privacy Policy).
Incidents
If a breach affects your personal data, we'll notify you and the authorities within the deadlines the law sets, including the Data Protection Board of India and CERT-In, and the relevant EU or UK authority where the GDPR applies.
Report a vulnerability
Write to support@outclass.design with "Security" in the subject. Please give us reasonable time to fix an issue before disclosing it, and don't access other people's data or disrupt the service while testing.
What we don't claim
We don't currently hold security certifications such as SOC 2 or ISO 27001. Our providers (Subprocessors) hold their own.