Security

This page describes how Tonpit protects your account and your content. It is written for security and procurement teams, and it is specific on purpose. The legal commitments behind it are in the Privacy Policy and the Data Processing Addendum. Questions go to hello@tonpit.com.

Tonpit runs on managed cloud platforms and operates no data centers of its own. The website and app are hosted on Vercel; sign-in, the database, file storage and media delivery are on Google Firebase and Google Cloud; render and capture servers run on Railway; video exports are rendered and delivered on Amazon Web Services. Customer data is stored in the United States.

Google Cloud, Amazon Web Services and Vercel each hold independent security certifications, including SOC 2 and ISO 27001. Every provider that handles customer content, with what it does and where it is based, is listed in Annex 3 of the DPA, and business customers get 14 days’ notice before one is added.

• In transit: all traffic uses HTTPS, and browsers are told to refuse plain HTTP for the whole domain (HSTS)
• At rest: the database, uploaded and generated files, and exports are encrypted at rest by our storage providers

• Sign-in is handled by Google Firebase Authentication, with Google sign-in or email and password. Tonpit never sees or stores passwords
• Every request for data is authorized per user, on the server and in the database’s own access rules, so an account reaches only its own content. The access rules are covered by automated tests
• A fresh sign-in is required before sensitive actions, such as deleting an account or creating an agent token
• Sign-in errors do not reveal whether an email address is registered

• Only Tonpit’s operator and people working for Tonpit under confidentiality may look at accounts and content, and only to give support you ask for, to monitor the Service’s quality and cost, for security and abuse prevention, and to meet legal obligations
• Administrative tools are limited to an allowlist of verified accounts, checked on the server
• The accounts that administer Tonpit’s infrastructure (hosting, database, source code, domain and payments) are protected with multi-factor authentication
• Service credentials are kept in our hosting providers’ environment settings, not in source code

You can connect your own AI agent to your Tonpit account. Its access is yours to grant, limit and take back.

• An access token is shown once and stored only in hashed form
• Each token carries the permissions you chose, an expiry date and a monthly spend ceiling, and can be revoked at any time in Settings
• Connector apps sign in through OAuth 2.1 with PKCE and a consent screen that shows what is being granted and to whom
• Every action an agent takes is recorded (which tool, when, and the outcome) and kept for 90 days
• Tokens of a disabled or deleted account stop working immediately

• Animation code, whether you or an AI assistant wrote it, runs in an isolated sandbox in the browser with no access to your session or account. On our render servers, only code our app has validated and signed is rendered
• Web pages fetched on your behalf are loaded through an egress policy that blocks private networks, and AI assistants treat their content as untrusted
• Uploaded images are checked by their actual content, not their file name, and every SVG is sanitized before it is stored
• Rate limits protect endpoints that could be abused or that spend money
• Payment notifications are accepted only with a valid signature
• Standard browser protections are set on every page: HSTS, clickjacking protection, content-type sniffing protection and a strict referrer policy
• Security review is part of developing the Service: changes that touch sign-in, customer data or outside input are reviewed for security before release

We do not sell your content and we do not use it to train AI models. Generating with Tonpit sends your inputs to the AI provider behind that feature, which processes them under its API terms. Which provider receives what is set out in section 4 of the Privacy Policy.

Uploaded and generated media files are served through direct links. A file’s link is long and random, it cannot be guessed, and files cannot be listed. But anyone who holds a file’s exact link can open it without signing in. This is how AI providers, our render servers and the agents you connect read your media.

Exported videos are different: they are stored privately, downloaded through signed links that expire, and deleted from the rendering service after one day.

If your organization needs media that only signed-in members can open, contact hello@tonpit.com before uploading confidential material.

The database is backed up every day and can be restored to any minute of the previous seven days. Backups are encrypted, stored with Google Cloud in the United States, and expire within 30 days.

You can delete files, projects or your whole account at any time in the Service. Deleting an account removes its data from our live systems right away; cached copies of media files and backup copies expire within 30 days. The full retention terms are in section 8 of the Privacy Policy.

Payments are processed by Lemon Squeezy, our Merchant of Record. Tonpit never receives or stores card numbers.

Tonpit keeps a written incident response procedure. If a personal data breach affects a business customer’s data, we notify that customer without undue delay and no later than 48 hours after becoming aware of it, as the DPA commits. The notice says what is known, which data and people are affected, and what we have done, and we update it as we learn more. We notify affected users and authorities where the law requires it.

• The Data Processing Addendum covers the GDPR, the UK GDPR and the Israeli Privacy Protection Law. It applies automatically to business customers, and a signed copy is available on request
• Tonpit is operated from Israel, which the European Commission recognizes as protecting personal data adequately
• Business customers can send us a written security questionnaire, and we answer it
• Tonpit does not hold a third-party security certification of its own, such as SOC 2 or ISO 27001, today

If you believe you have found a security problem in Tonpit, email hello@tonpit.com with what you found and how to reproduce it. We read every report and reply as quickly as we can.

Please test only against your own account, do not access or change other people’s data, do not degrade the Service, and give us reasonable time to fix a problem before making it public. We will not take legal action over research done in good faith within these limits. We do not run a paid bug bounty.