Security at CreonAI

Last updated: 24 September 2026

What this page covers. Where CreonAI runs, how your password and your payments are handled, and how to tell us about a security problem. It describes what is in place today and nothing more.

Where CreonAI runs

Amazon Web Services, in London (eu-west-2). The app runs on AWS App Runner, the database is Amazon RDS for PostgreSQL, and files are stored in Amazon S3 and delivered through Amazon CloudFront.
HTTPS everywhere. The site, the app and every request they make to our servers use HTTPS.

Your password

Passwords are hashed with bcrypt before they are stored, so we keep a hash of your password and never the password itself.

Payments

Card payments are handled by Stripe. Stripe is a PCI DSS Level 1 service provider. Your card details go to Stripe, and CreonAI never sees your card number.
In-app purchases on iPhone are handled by Apple. A purchase made in the iPhone app goes through Apple, and CreonAI receives only a confirmation that it happened.

Certifications

CreonAI does not hold a security certification of its own. AWS and Stripe maintain their own security certifications for the services we use from them.

Report a security issue

If you think you have found a security problem in CreonAI, email marco@creonai.io with what you found, the steps to reproduce it and what you think it affects.

Please give us the chance to fix it before you share it publicly, and do not access or change anyone else's data while you look into it.