Trust center

Security at Drawtryix

Learn about Drawtryix account, storage, asset, browser, and AI-pipeline security practices and how to report a vulnerability responsibly.

Effective August 6, 2026

Private storage

Signed-in drawings, generated images, and 3D models are designed to use private storage and time-limited delivery links.

Profile-scoped access

Account and selected-player checks protect jobs, characters, models, and assets.

Asset inspection

File type, size, pixel, geometry, material, texture, moderation, and integrity checks can reject unsafe or broken inputs.

Security practices

Encrypted HTTPS connections and strict transport security.
Private object storage, database row-level security, and profile ownership checks.
Short-lived signed asset URLs rather than permanent public files.
Server-only AI and storage credentials; privileged secrets are not shipped to the browser.
Restricted browser capabilities, framing protection, content security policy, and referrer controls.
Upload, image, model, request-size, quota, and concurrency limits.
Content moderation, metadata removal, and generated-asset validation.
Replay-safe job identities and provider callback verification.

No service can guarantee perfect security. Safeguards are reviewed and updated as the product, providers, and identified risks change.

Report a vulnerability

Please report suspected vulnerabilities privately. Do not include children's drawings, names, access tokens, passwords, or other unnecessary personal information. Do not publicly disclose a vulnerability before we have had a reasonable opportunity to investigate and protect families.

Email contact@noctryix.com with “Drawtryix security report” in the subject, or use the Noctryix contact form.

Our machine-readable disclosure instructions are available at /.well-known/security.txt.