Security

1. Our Commitment to Security

At Lowside Labs, security is fundamental to how we build and maintain Aibō. We implement industry-standard security practices and continuously monitor and improve our security posture to protect your data and privacy.

2. Data Encryption

2.1 Encryption in Transit

All data transmitted between your browser and our servers is encrypted using Transport Layer Security (TLS) 1.3 or higher. This ensures that your conversations, prompts, and account information cannot be intercepted during transmission.

2.2 Encryption at Rest

All data stored in our databases is encrypted at rest using industry-standard AES-256 encryption. This includes your captured conversations, prompts, export history, and account information.

2.3 Password Protection

When you create password-protected share links, passwords are hashed using bcrypt with appropriate work factors. We never store plaintext passwords for shared content.

3. Infrastructure Security

3.1 Trusted Cloud Providers

We partner with industry-leading cloud providers that maintain rigorous security certifications:

• Convex: Backend database and serverless functions with automatic backups and disaster recovery
• Cloudflare: Rendering services with DDoS protection and edge security
• Clerk: Authentication services with SOC 2 Type II compliance

3.2 Network Security

• Web Application Firewall (WAF) to protect against common attacks
• DDoS protection and rate limiting
• Regular security audits and penetration testing
• Intrusion detection and monitoring systems

4. Browser Extension Security

4.1 Minimal Permissions

The Extension requests only the minimum permissions necessary to function. We do not request access to browsing history, all websites, or other sensitive browser data beyond what is required for core functionality.

4.2 Content Security Policy

We implement strict Content Security Policies (CSP) to prevent cross-site scripting (XSS) attacks and ensure that only trusted code executes within the Extension.

4.3 Code Review and Updates

• All code changes undergo security review before deployment
• Regular security updates to dependencies and libraries
• Automated vulnerability scanning of dependencies
• Prompt patching of identified security issues

5. Authentication and Access Control

5.1 User Authentication

• Industry-standard authentication via Clerk
• Support for OAuth providers (Google, GitHub, etc.)
• Session management with automatic timeout
• Optional multi-factor authentication (MFA)

5.2 Access Controls

• Role-based access control for internal systems
• Principle of least privilege for all services and accounts
• Audit logging of sensitive operations
• Regular access reviews and revocation of unused credentials

6. Data Protection Practices

6.1 Data Minimization

We collect only the data necessary to provide our services. We do not collect browsing history, personal conversations outside of what you explicitly capture, or other unnecessary personal information.

6.2 Data Sanitization

All user-generated content is sanitized before processing to prevent injection attacks and ensure safe rendering in exports and shares.

6.3 Secure Deletion

When you delete content or your account, we ensure secure deletion of your data from our systems within 30 days, except where retention is required by law.

7. Incident Response

7.1 Security Monitoring

We continuously monitor our systems for security threats and anomalous behavior using automated tools and manual oversight.

7.2 Incident Response Plan

We maintain a documented incident response plan that includes:

• Rapid detection and containment of security incidents
• Investigation and root cause analysis
• User notification when personal data is affected
• Remediation and prevention of future incidents
• Compliance with breach notification requirements

8. Third-Party Security

8.1 Vendor Management

We carefully vet third-party services and regularly review their security practices. All vendors are required to maintain appropriate security standards and certifications.

8.2 AI Platform Integration

The Extension captures content from AI platforms (ChatGPT, Claude, Gemini, etc.) only when you explicitly use the capture feature. We do not access or store conversations unless you actively save them.

9. Compliance and Certifications

We are committed to maintaining compliance with relevant security and privacy regulations, including:

• General Data Protection Regulation (GDPR)
• California Consumer Privacy Act (CCPA)
• Industry best practices and frameworks (OWASP, NIST)

10. Responsible Disclosure

10.1 Security Vulnerability Reporting

If you discover a security vulnerability in Aibō, we encourage responsible disclosure. Please report security issues to us.

10.2 Our Commitment

• We will acknowledge receipt of your report within 48 hours
• We will investigate and validate reported vulnerabilities promptly
• We will keep you informed of our progress
• We will credit researchers who responsibly disclose vulnerabilities (if desired)
• We will not pursue legal action against researchers who follow responsible disclosure practices

11. Security Best Practices for Users

We recommend the following security practices when using Aibō:

• Keep your browser and the Extension updated to the latest version
• Use strong, unique passwords for your account
• Enable multi-factor authentication when available
• Use password protection for sensitive shared content
• Review and revoke share links you no longer need
• Be cautious about what content you capture and share
• Log out from shared or public computers

12. Contact Us

For security-related questions, concerns, or reports, please contact us.