Accounts and access
Passwords are stored only as a hash; there is no path by which anyone here can read yours. Sessions use short-lived access tokens with a separate refresh token, so a leaked token expires on its own.
Every project, scene and character is scoped to the account that owns it, and that ownership is checked on the server for each request — not merely hidden in the interface.
Repeated sign-up attempts from one network are rate limited, and an administrator can block an address outright.
Your files
Uploads and generated media live in per-account paths in object storage. Traffic is encrypted in transit.
A reference photo is sent to the face-matching model so your likeness stays consistent across scenes, and stored with your project. It is never shown to another user and never used to train a model. Deleting the character deletes the photo.
What reaches third parties
Generating video means sending your content to the services that do the work: GPU hosts for the image and video models, a language model for the script, and speech and music services for the audio. Each receives only what its job needs. The full list, and what each one gets, is in the privacy policy.
We do not sell data, and your prompts and finished videos are not used to train our models.
Content safety
Prompts are screened against our content rules before a job is queued, so a blocked prompt never reaches a GPU — and costs you nothing. Generated images are checked as well, and anything a user reports goes to a moderation queue an administrator works through.
Your control
You can export everything we hold about you as a machine-readable file, and delete your account along with its projects, uploads and generated media, from your account settings. Neither needs a request form.
Not yet
Being straight about the gaps is more useful than a longer list of strengths:
- No SOC 2 or ISO 27001 certification. We are a small team and have not been through either audit.
- No customer-managed encryption keys, and no single-tenant deployment option.
- Two-factor authentication is not available yet. It is the next account-security item on the roadmap.
- No published bug-bounty programme.
Reporting a problem
If you find a vulnerability, write to security@qmotion.ai with enough detail to reproduce it. We will confirm receipt, and we will not pursue anyone who reports in good faith and gives us time to fix it before going public.