Your data is not our product
Last Updated: March 9, 2026
People trust Secret Desires AI with their most private thoughts. We take that seriously. Here's the infrastructure, encryption, and independent verification behind that trust.
AI privacy#
Your conversations are not training data#
Your conversations are processed by AI providers that contractually guarantee zero data retention. Messages are processed and immediately discarded — never stored, never logged, never used for training. We enforce routing rules that exclude any provider that trains on user data.
When self-hosted models are available, conversations never leave our infrastructure at all.
Encryption#
Data at rest#
All stored data is encrypted using AES-256 via LUKS full-volume encryption, with a unique encryption key per customer project. Backups are encrypted with RSA-4096.
Data in transit#
All connections are encrypted with TLS. Traffic between your browser and our servers is encrypted end-to-end through Cloudflare's global network.
Network security#
Cloudflare network protection#
Our network layer is protected by Cloudflare, providing:
- DDoS protection — always-on, unmetered mitigation across 330+ global data centers
- Web Application Firewall (WAF) — filters malicious traffic before it reaches our servers
- Bot management — automated threat detection and rate limiting
- Origin IP masking — our server IPs are never publicly exposed
Infrastructure#
Data center security#
Our infrastructure is hosted by OVH, whose data centers are certified to:
- ISO 27001 — information security management
- ISO 27017 — cloud security controls
- ISO 27018 — protection of personal data in the cloud
- ISO 27701 — privacy information management
Facilities include 24/7 physical security, video surveillance, badge access, and mantraps.
Authentication#
Account authentication is handled by Firebase (Google). We support OAuth sign-in via Discord, Google, and X — meaning we never store your password. Firebase provides built-in brute force protection and rate limiting on authentication attempts.
Independent security verification#
SOC 2 Type I & II
Audit in progress with Delve. Initiated February 2026. Covers security, availability, and confidentiality controls.
Penetration testing
Independent testing by Casco Security and BSK Security. External teams actively probe our systems for vulnerabilities.
Delve Trust Hub
Public trust profile coming soon — a third-party verified view of our security and compliance posture.
Privacy#
Billing privacy#
Charges appear as "SDAI" on your statement. Designed to be discreet — nothing that identifies the nature of the service.
Data minimization#
We collect only what's required for the product to function: account information, conversation history, generated images, and subscription data. We don't collect what we don't need. Our revenue comes from subscriptions — not from monetizing your information.
