Security
How we keep your account safe
What we do today to protect your account, your payments and your data, in plain words.
Payments
Our payment processor, the merchant of record, takes every payment on its own secure checkout page. Your card number never reaches TurboUGC, and we don't store it. For the free trial we keep only a keyed one-way fingerprint of the card, so each card gets one trial; never the card details.
Encrypted connections and tokens
Every page and request uses HTTPS, and browsers are told to use nothing else. Information is encrypted at rest with our providers. Tokens and keys for accounts connected to TurboUGC are encrypted before they're stored, with keys we keep in a dedicated key service, and each time one is opened it's logged.
Each customer's data walled off
The database itself keeps every workspace's data apart (row-level security): each request from the studio can only read and change the workspace it's made for. An automated test suite checks that one workspace can't reach another's.
Your data, your call
Download a copy of your data in Settings → Account → Download my data. Delete videos, products and avatars at any time, or your whole account in Settings → Account → Delete account. Delete your data lists every step and what we must keep.
Two-step verification
Turn it on for your own account in Settings → Account → Two-step verification. Our admin console won't open for staff without it, and admin actions are recorded in an audit log. We never see or store your password: our sign-in provider handles it.
No trackers on this site
This website runs no ads or analytics and loads no third-party scripts. The cookies the service uses are listed in our Privacy Policy.
Report a security issue
Email security@turbougc.com with what you found, the steps to reproduce it and how it could be used. Please don't access other people's data, disrupt the service, or share the issue before we've fixed it.
Our contact for security researchers is also in /.well-known/security.txt.
No system is perfectly secure. If a breach affects you, we'll tell you as the law requires.
We don't hold a security certification such as SOC 2 or ISO 27001.