Security

PinePaper's design principle is simple: your client-side work stays free and private; only what you explicitly send to the cloud is processed server-side, authenticated and paid.

Privacy by architecture

The PinePaper editor runs entirely in your browser. Interactive editing never touches our servers — your scene lives in local storage on your device. The cloud only ever receives data you deliberately hand it:

• Saved templates — opt-in cloud sync; otherwise they stay local.
• Render jobs — the specific scene + export profile you submit to render.
• AI requests — the instruction/context you send for inference.

If you never sync and never submit a job, we hold nothing but your account record.

Authentication

• Sign-in via Google or GitHub OAuth, or device passkeys (WebAuthn) — we never handle your password.
• Sessions are short-lived signed tokens (JWT), with step-up re-authentication required for sensitive actions.
• Agents authenticate with scoped service-account keys — each key is limited to specific permissions (render:create, scene:validate, …) with a per-key spend cap and expiry, so a human grants a bounded mandate to their agent. API keys are stored only as salted hashes; the secret is shown once.

Render isolation

A scene document is untrusted input: effectively a small program our render farm executes. It runs under strict isolation, treated as a security boundary, not an optimization:

• One isolated browser context per job — no shared state between renders.
• No network egress from the render context.
• A hard wall-clock timeout — a job can't run away.
• Resource ceilings (duration, resolution, item count) enforced up front at :estimate time with structured diagnostics — never discovered mid-render.

Data handling

• In transit: everything is served over TLS (HTTPS), terminated at Cloudflare's edge.
• At rest: account data and templates live in Cloudflare KV and R2.
• Your control: you can export all your data as JSON or delete your account at any time from your dashboard.

Payments

All card payments are handled by Stripe. We never see, transmit, or store your card details — Stripe carries the PCI burden. We retain only a customer reference and your credit balance.

Email authentication

Mail from pinepaper.studio is authenticated with SPF, DKIM, and DMARC, so receivers can verify our messages are genuinely from us and reject spoofed ones.

We don't yet claim formal certifications or an uptime SLA — we'll publish those when we can back them with evidence. See also our Privacy Policy and Terms.