Security Policy

Sauci AI (“Company,” “we,” “our”), operated by REGNEXT EOOD (UIC 208608387), is committed to maintaining the highest standards of security, privacy, and data protection for all users.

This Security Policy explains how we safeguard user data, protect platform integrity, and respond to potential security incidents across sauci.ai and all associated systems.

Security, safety, and reliability are core pillars of our platform.

1. Our Security Principles

We follow four core security principles:

1. Minimize data collected → We store as little personal data as possible.
2. Protect all stored and transmitted data → Encryption everywhere (at rest + in transit).
3. Limit access → Only authorized staff can access sensitive systems.
4. Monitor and improve continuously → Security evolves with threats.

2. What Data We Collect and What We Don’t

2.1. Data We Do Collect

We only collect what is necessary to operate our services:

• Account data (email, password hash, login history)
• Payment history (token purchases, subscription status — never full card numbers)
• User settings and preferences
• AI character settings and interactions (encrypted)
• Device, browser and IP metadata (security & fraud prevention)

2.2. Data We Do Not Collect

To ensure user privacy:

• We do not collect real images of users
• We do not collect real videos or voice recordings of users
• We do not store uploaded personal identity documents (except in rare fraud/AML cases)
• We do not train our AI models on personal data
• We do not process sexual content involving real people, all content is AI-generated
• We do not sell or share personal data with advertisers

Sauci AI is designed as a privacy-first adult AI platform.

3. Encryption & Data Protection

We use industry-standard encryption to secure all data:

3.1. Encryption in Transit

All data transmitted between your device and Sauci AI servers is protected with:

• TLS 1.3 or higher
• HSTS (HTTP Strict Transport Security)
• Modern cipher suites and secure handshakes

3.2. Encryption at Rest

All stored data is encrypted using:

• AES-256
• Encrypted volumes and database-level encryption

3.3. Password Protection

User passwords are:

• hashed using bcrypt or Argon2
• never stored in plain text
• protected by rate limits and login attempt monitoring

4. Infrastructure & Access Control

4.1. Hosting & Certifications

Our infrastructure is hosted on platforms meeting:

• SOC 1 Type II
• SOC 2 Type II
• ISO 27001
• PCI DSS (payment security)

The hosting environment includes:

• Encrypted databases
• DDoS protection
• Automated backups
• Multi-availability-zone redundancy

4.2. Internal Access Controls

Only select authorized personnel may access production systems, and only when necessary. Access is controlled through:

• Role-based access control (RBAC)
• Multi-factor authentication (MFA)
• IP restrictions
• Audit logging

Systems are regularly reviewed for unnecessary privileges, least-privilege principle.

5. Fraud Prevention & Abuse Detection

Sauci AI maintains automated and manual systems to detect:

• suspicious login patterns
• brute-force attempts
• payment fraud
• crypto wash activity
• scraping or automation attacks