Security
How Eklipsa handles your data.
Understand account access, AI processing, storage, and your options to export or delete information.
Who can access client work
Publication
You decide what becomes published Brand Intelligence. Publishing selects the strategy later supported workflows can use. It does not grant or remove permission to open the account, and it is not a security guarantee.
Access
You control access to the work you share. Client reviewers see the material made available to them; internal strategy development remains subject to your account's permissions.
Sign-in is handled by Supabase Auth. Organization roles limit who on an account can view or change a brand. Database row-level security keeps one account's rows separate from another's. The product enforces organization roles and row-level security. Other customers' accounts cannot read your brand rows through the application.
AI training and optional visual-style training
Brand data powers Brand Intelligence inside your account. You keep ownership of what you submit.
You own your content
You retain ownership of content you create, upload, or submit. We do not sell personal information. The Privacy Policy lists the service providers that process data to run the product.
Accounts stay separate
Brand context in a request is limited to that account. One account's Brand Intelligence is not copied into another account's prompts.
Third-party foundation models
We do not use your brand data to train, fine-tune, or improve third-party foundation models. If you start optional visual-style training, the assets you select are sent to fal.ai to train a style model for that brand. That step runs only when you start it.
Infrastructure controls
Certifications named here belong to that provider. Eklipsa does not claim those certifications for itself.
- Production responses use HTTPS, HSTS, a content security policy, frame denial, and MIME sniffing protection
- Organization roles and row-level security separate customer data between accounts
- Stripe Checkout and the Stripe customer portal collect payment details. Eklipsa does not store full card numbers
- Billing webhooks are accepted only after Stripe's signature check
- Application functions run in Vercel US East (iad1). Database, auth, and files are in Supabase US East (us-east-1)
- Automated tests cover tenant isolation and signed billing webhooks
Visitors reach the site over HTTPS. In production the app sends HSTS, a content security policy, frame denial, and MIME sniffing protection. Supabase states that disks and backups are encrypted at rest with AES-256, and that its network traffic uses TLS 1.2 or newer.
Automated tests cover tenant isolation, privileged database functions, and signed billing webhooks. Those checks cover this product. They are not a third-party certification of Eklipsa.
Account, brand, and file data live in Supabase in one US East region (us-east-1). Application functions run on Vercel in US East (iad1). Supabase documents daily backups on paid plans. This page does not state a restore window or a second live database region.
This list describes controls in the product. It is not an audit report, and it is not an Eklipsa certification.
- Payments
- StripeStripe is a PCI DSS Level 1 service provider. That certification belongs to Stripe. Card numbers are collected by Stripe. Eklipsa does not store full card numbers.
- Database, auth, and files
- SupabaseSupabase states that its platform is SOC 2 Type 2. That certification belongs to Supabase. Supabase states that disks and backups are encrypted at rest with AES-256, and that network traffic uses TLS 1.2 or newer.
- AI providers
- OpenAI, Anthropic, Groq, fal.ai, GammaText features use OpenAI or Anthropic. In production those requests go through Vercel AI Gateway. Economy text models may be hosted by Groq through that gateway. Image and visual generation uses fal.ai. Deck generation uses Gamma when you run it. Content is sent when you use the feature.
- Hosting
- VercelVercel hosts the application. Serverless functions run in US East (iad1). Vercel terminates HTTPS and provides platform DDoS mitigation. Those controls belong to Vercel.
Exports and deletion
You can delete a brand from brand settings and delete your account from profile settings. You can export deliverables the product already exports, including a Brand Book as DOCX, and you can request a copy of personal information at legal@eklipsa.ai. We respond to emailed requests within 30 days. Deletion follows the retention policy. It does not instantly erase every backup. Canceling a paid plan ends billing at the close of the current period. Canceling does not by itself delete brand data.
Report a security concern
The Privacy Policy describes how we notify affected people after a security incident involving personal information. Report a vulnerability to legal@eklipsa.ai.
For the full policy, see the Privacy Policy and Terms of Service. Compare plans on the pricing page.
Questions
Detailed questions
The product enforces organization roles and row-level security. Other customers' accounts cannot read your brand rows through the application.
Brand data is used to power your Brand Intelligence inside Eklipsa. We do not use it to train, fine-tune, or improve third-party foundation models. We do not sell personal information. If you start the optional visual-style training step, the assets you select are sent to fal.ai to train a style model for that brand. That step runs only when you start it.
Canceling a paid plan ends billing at the close of the current period. Canceling does not by itself delete brand data. You can delete a brand from brand settings or delete your account from profile settings. You can also request deletion at legal@eklipsa.ai. We respond to emailed requests within 30 days. Deletion follows the retention policy. It does not instantly erase every backup.
Account, brand, and file data are stored with Supabase in a single US East region (us-east-1). Application functions run on Vercel in US East (iad1). Supabase documents daily backups on paid plans. This page does not state a restore window or a second live database region.
Email legal@eklipsa.ai. The Privacy Policy describes how we notify affected people after a security incident involving personal information.
Evaluate Eklipsa with one client
The Professional Pilot is application-based. No credit card is required to apply.
One qualifying client. 30 days from client activation. 100,000 credits once. No credit card.