Security

How we handle data

• API keys are stored as SHA-256 hashes; the plaintext is shown only once at issuance.
• We do not store prompt or AI output content — only token counts for billing.
• Card data never touches our servers; payments are processed by Stripe (PCI DSS).
• All traffic is TLS-encrypted; the database is encrypted at rest (Neon).
• Passwords are stored hashed (BetterAuth). TOTP two-factor authentication is available.

How we record money

• Balances live in an append-only double-entry ledger; every operation carries an idempotency key.
• Sensitive operations (issuance, redemption, freezes) are written to an audit log.

Reporting a vulnerability

If you find a vulnerability, please email support@tokengift.ai. We aim to respond within 3 business days and ask that you keep findings private until a fix ships. We will not pursue legal action against good-faith research. Contact details are also published in security.txt.