Security

Effective date: November 8, 2026

In short: API keys and passwords are stored only as hashes. Result files are private and reached through download links that are signed and expire after 5 minutes. Webhooks are signed so you can check they came from us. Result files are deleted after 7 days and uploads after 24 hours. Card payments go through Stripe, and we never see your card number. The providers that process data for us are listed at the end of this page.

This page describes how VizoAPI, operated by Oakrelay Labs LLC, protects your account, keys, files and payments. Our privacy policy says what personal data we collect and why.

API keys

• A key is shown in full once, when you create it. We store a SHA-256 hash of it and its first characters, so you can recognize it in the console. Nobody at VizoAPI can read your key back.
• Each key belongs to one project and can be limited by daily and monthly budget, by model, by IP address and by expiry date. You can revoke a key at any time.
• The console shows which IP addresses used each key in the last 7 days, so you can spot a leaked key.
• Keep keys on your server. Never put them in a browser, a mobile app or a public repository.

Accounts and sign-in

• Passwords are stored as salted Argon2id hashes, never in readable form.
• You can also sign in with a one-time email code or with Google. Sign-in and sign-up pages use Cloudflare Turnstile to block bots.
• A session ends after 12 hours without use or after 7 days at most. Session cookies are first-party, secure and not readable by page scripts.

Files and downloads

• Input and result files are stored privately. There are no public links to them.
• To download a result, your code asks the API for a download link. The link is signed for that one file, works only for reading it (GET and HEAD), and expires 5 minutes after it is issued. It goes to our media host without your API key.
• Files under a content review are blocked from download while the review is open.

Webhooks

• Webhook requests are signed per the Standard Webhooks specification: the webhook-signature header carries an HMAC-SHA256 of the event ID, the timestamp and the raw body, made with your endpoint’s signing secret.
• Check the signature and the webhook-timestamp header (reject anything older than 5 minutes) before you act on an event; an official Standard Webhooks library does both. The webhook event reference shows how.
• Retried deliveries keep the same event ID, so you can safely ignore duplicates.

Data retention

• Result files: deleted 7 days after they are created. You can delete them sooner.
• Uploaded input files: deleted 24 hours after upload.
• API key source IP addresses: deleted 30 days after the address was last seen, and at once when the account is closed.
• Task records (prompt, parameters, status, price): kept while your account is open, so you can see your history.
• Files under a content review: kept up to 30 days while the case is open.
• Account closure: we revoke your keys, cancel tasks still waiting, delete your files, erase task inputs and webhook settings, and remove your sign-in details. Billing records are kept as tax and accounting law requires.

The privacy policy lists every retention period.

Payments

• Credits are bought through Stripe Checkout. Your card details go straight to Stripe; we receive only a payment reference, the status and, for auto top-up, the card brand, last 4 digits and expiry date.
• Payment events from Stripe are checked against Stripe’s webhook signature before your balance changes.

Network

• The site, the API and file downloads are served over HTTPS only, with HSTS.
• Our servers are not reachable directly from the internet: traffic reaches them through Cloudflare.
• Database backups are encrypted before they leave the server.

Reporting a security issue

If you find a vulnerability, write to support@vizoapi.com with the details and steps to reproduce it. Please give us a reasonable time to fix it before you share it publicly, and do not access other people’s data or disrupt the service while testing. We reply to every report.

Subprocessors

These service providers process customer data on our behalf, each only for the purpose shown. We update this list when it changes.