Security

Last updated: August 21, 2026

This is a real account of how Emperor is built and secured today — not a marketing page. It isn't a formal security policy or a compliance certification.

1. Authentication

Sign-in runs entirely through Clerk, a dedicated identity provider — we don't build or store our own password system. Clerk handles credential storage, session tokens, and account recovery, so your login details never pass through or live on our own servers.

2. Encryption

All traffic between your browser and Emperor is encrypted with TLS. Your reference images, generated content, and account data are encrypted at rest by our infrastructure providers.

3. Storage & Access Controls

Reference photos and generated images and video are stored in private Cloudflare R2 buckets — nothing is publicly listable or guessable by URL. Access is scoped so that only your own account can retrieve your own content through the app.

4. Content Moderation

Every generation on Emperor passes through a multi-layer moderation pipeline before it's delivered:

• Every prompt is checked against a blocklist before it's ever sent to a model
• Prompts also pass through an automated moderation-classification API
• Generated images are scanned with AWS Rekognition for policy-violating content before delivery
• Flagged content is held for manual review rather than delivered automatically

5. Payment Security

All payments are processed by Stripe, a PCI-DSS Level 1 certified payment processor. Emperor never receives or stores your full card number, expiration date, or CVC — that data goes directly to Stripe.

6. Responsible Disclosure

If you believe you've found a security vulnerability in Emperor, please report it to [security email] before disclosing it publicly. We'll investigate and respond as quickly as we can. Please don't access or modify data that isn't yours while testing.