Security

PinePaper's design principle is simple: your client-side work stays free and private; only what you explicitly send to the cloud is processed server-side, authenticated and paid.

Privacy by architecture

The PinePaper editor runs entirely in your browser. Interactive editing never touches our servers — your scene lives in local storage on your device. The cloud only ever receives data you deliberately hand it:

• Saved templates — opt-in cloud sync; otherwise they stay local.
• Render jobs — the specific scene + export profile you submit to render.
• AI requests — the instruction/context you send for inference.

If you never sync and never submit a job, we hold nothing but your account record.

Authentication

• Sign-in via Google or GitHub OAuth, or device passkeys (WebAuthn) — we never handle your password.
• Sessions are short-lived signed tokens (JWT), with step-up re-authentication required for sensitive actions.
• Agents authenticate with scoped service-account keys — each key is limited to specific permissions (render:create, scene:validate, …) with a per-key spend cap and expiry, so a human grants a bounded mandate to their agent. API keys are stored only as salted hashes; the secret is shown once.

Render isolation

A scene document is untrusted input: effectively a small program our render farm executes. It runs under strict isolation, treated as a security boundary, not an optimization. Live service health is on the status page.

• Renders run in isolated containers — the render engine runs in Node beside ffmpeg, with no browser; each render is owned by its own coordinator and its images, footage and sound are handed to it by the service rather than fetched.
• No network egress from the render context.
• A hard wall-clock timeout — a job can't run away.
• Resource ceilings (duration, resolution, item count) enforced up front at :estimate time with structured diagnostics — never discovered mid-render.

Data handling

• In transit: everything is served over TLS (HTTPS), terminated at Cloudflare's edge.
• At rest: account data and templates live in Cloudflare KV and R2.
• Your control: you can export all your data as JSON or delete your account at any time from your dashboard.

Payments

All card payments are handled by Stripe. We never see, transmit, or store your card details — Stripe carries the PCI burden. We retain only a customer reference and your credit balance.

Email authentication

Mail from pinepaper.studio is authenticated with SPF, DKIM, and DMARC, so receivers can verify our messages are genuinely from us and reject spoofed ones.

Regulatory & standards compliance

Where we stand on AI transparency, data privacy and media authenticity standards. This is a description of what is built, not a claim of legal compliance:

• EU AI Act (Article 50): Partial: unsigned disclosure metadata. Cloud MP4, WebM, GIF, PNG and PDF renders embed an unsigned machine-readable pinepaper.provenance/1 record; /verify reads the PNG and GIF ones.
• EU GDPR & ePrivacy: Self-service account erasure (Art. 17), data export (Art. 20), Google Consent Mode v2 gating, and zero user tracking in exported media files.
• California SB 942: Partial: unsigned disclosure metadata (the same record). It is not tamper-evident; signing is planned.
• C2PA Content Credentials: Unsigned provenance metadata live; C2PA signing pending conformance enrolment. Creators can add a visible mark with a public verify code; imperceptible watermarking is not built.

View the live breakdown of all active, in-progress, and planned standards on our Standards & Compliance Ledger →

We don't yet claim formal certifications or an uptime SLA — we'll publish those when we can back them with evidence. See also our Privacy Policy and Terms.