Security Policy

1. Your password and sign-in

• Passwords are hashed with bcrypt before they are stored. We cannot look up or recover your password — if you lose it, you reset it, you do not retrieve it.
• You can turn on two-step sign-in (an authenticator app code, in addition to your password) from Settings. The secret it uses is encrypted at rest, not stored in plain text.
• “Continue with Google” verifies your identity with Google directly; we never see or store your Google password.
• You can see every device signed in to your account — a label for it, its IP address, and when it was last active — and sign any of them out individually, or all of them at once, from Settings.
• Changing your password signs out every other device automatically, in case the password was changed because someone else had learned it.

2. Payment security

Your card details never reach Onaxai’s servers. Paying and managing your subscription happens directly on Stripe’s own pages, which are PCI-DSS compliant. What we store is limited to a reference to your Stripe customer record and the history of what you were charged — never a card number.

3. Encryption

• Every connection to Onaxai — the app itself and its API — is encrypted in transit with TLS.
• Two-step sign-in secrets are encrypted at rest, independent of the database they are stored in.
• Passwords are never stored in a reversible form (see Section 1).
• Files you upload or that are generated for you are stored with our storage provider’s own encryption at rest.

4. Access controls inside Onaxai

• Staff access to the admin tools that can see account or billing details is limited to the people who need it to run the product and support users, and is itself behind a signed-in, role-checked account.
• A sensitive admin action — changing someone’s plan, suspending an account, and similar — is written to an internal audit log recording who did it, when, and what changed, so there is a record to review.
• An account’s own sensitive actions — changing its email or password, turning two-step sign-in off, deleting the account — require that account’s own password again, even from an already signed-in session.

5. Infrastructure

Onaxai’s backend and database run with a hosting provider responsible for the physical and network security of the servers; the web app is served from a global content delivery network. Our dependence on each provider, and theirs on their own sub-processors, is covered in general terms in our Privacy Policy.

6. What we ask of you

• Use a password you do not reuse elsewhere, and turn on two-step sign-in if you can.
• Check the device list in Settings occasionally, and sign out anything you do not recognize.
• Do not share your password or your access token with anyone, including a browser extension or a third-party tool you have not verified yourself.

7. Reporting a security issue

If you believe you have found a security vulnerability in Onaxai — not an account-specific support issue, but an actual flaw in how the product or its infrastructure works — please tell us before telling anyone else, at security@onaxai.xyz. Include enough detail to reproduce the issue. We will acknowledge a genuine report, investigate, and fix confirmed issues; we ask that you give us a reasonable period to do so before any public disclosure, and that you do not access, modify, or delete data beyond what is needed to demonstrate the issue. We will not pursue legal action against a good-faith report made under this policy.

8. If something goes wrong

If we become aware of a security incident affecting your data, we will tell you and take the steps the law where you live requires, without unreasonable delay.

9. Changes to this policy

We may update this policy as our practices change. It describes what we actually do; if something here stops being accurate, we will correct it.

10. Contact

Vulnerability reports: security@onaxai.xyz. Everything else: support@onaxai.xyz.