Trust Center

Security at Camile AI

This is the public view of our security, privacy, and governance practices. We document what we actually do — and how to verify it.

1. Authentication

Passwords protected with scrypt (N=16384) and per-user salt; sessions in httpOnly cookies with SameSite=Lax; two-factor verification (TOTP or email); rate limits against brute force on login, signup, and recovery.

2. Data isolation

Every institution (tenant) is isolated at the database layer with enforced Row-Level Security: scoped access prevents cross-customer reads by construction, not by convention.

3. Audit and provenance

Sensitive events are recorded in an append-only ledger — authorizations, consents, and administrative operations — with per-entity verifiable trails.

4. Privacy and LGPD

Per-scope consents (LGPD art. 8), data export at any time, and the right to erasure with real removal. Data stored on infrastructure in Brazil.

5. Responsible access

The platform is for adults 18+. Affection and memory are the default; intimacy features require explicit consent, in an auditable ledger, revocable at any time.

6. Report a vulnerability

Found something? Write with reproduction steps. We investigate and respond — no retaliation. security@camileai.com