Security

Motifuse spans free public tools that need no account and paid products that hold customer data. The security model follows from that split: keep work on your device wherever the task allows, make every server-side path explicit and labelled, and scope everything that is stored to exactly one workspace.

Three rules do most of the work. Collect as little as the feature needs. Never let the interface misstate where processing is happening. And fail closed — when a check cannot produce an answer, the operation is refused rather than allowed through.

A workspace account can be used two ways, and both end in the same kind of session:

• A single-use sign-in link emailed to your address, valid for 20 minutes.
• A password, if you set one. Passwords must be at least 10 characters with upper case, lower case, and a digit, and are stored using scrypt with a per-account salt — never in a form that can be reversed.

A successful sign-in issues a 256-bit random session token. The token is stored server-side only as a SHA-256 hash, so the database holds nothing that could be replayed as a session, and it reaches your browser as an HTTP-only cookie that page JavaScript cannot read. Sessions expire after about 30 days, or immediately when you sign out.

Because sessions are cookie-based, every state-changing API route verifies the request origin before acting. That closes cross-site request forgery, including against sign-in itself.

Administrative routes are a separate system. They require a distinct header token, check a named permission for each action, and write an audit record. A customer session cannot reach an admin route no matter what it is pointed at.

Every project, dataset, template, document, job, and output belongs to exactly one account. Ownership is enforced inside the query rather than checked afterwards: the data-access helpers take the owner filter as a pre-bound argument, so a query cannot be written without it.

Entitlements work the same way. What your plan allows is resolved server-side on every request from the authoritative plan record. The browser is never asked what plan you are on, and telling the API you are on a different one changes nothing.

SpecTrace additionally supports working without an account. That guest identity is a separate cookie tied to one browser; the work is deleted after 7 days, and it transfers to a real account if you create one. A guest is never treated as a signed-in customer.

What happens to a file depends entirely on which product and which mode you are using. This is the most important table on the page.

Cloud inputs and outputs live in private object storage. Buckets are not publicly readable, and there is no anonymous URL that resolves to a customer file. When you download something, the server confirms you own it and then issues a signed link that expires within minutes.

Retention is enforced by the platform rather than left to a cleanup someone has to remember:

Where a product shows a deletion time in its interface, that is the time the platform will act on. You can always delete earlier than the retention window; deletion removes the stored bytes on the schedule the storage lifecycle rules enforce.

Subscriptions and project payments are processed by Razorpay. Card numbers, CVVs, UPI credentials, and bank details are entered into Razorpay’s own checkout and are never received, transmitted, or stored by Motifuse. What we hold is the outcome: which plan you are on, the provider’s reference for the payment, and the invoice record.

Payment webhooks are verified against the provider’s signature before any subscription state changes, so a forged callback cannot grant an entitlement.

• The site is served over HTTPS. Responses carry a Content Security Policy, and production adds HTTP Strict Transport Security alongside X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
• Secrets — database credentials, storage keys, payment keys, mail and AI API keys — are supplied as environment variables and never appear in client-side code. The build refuses to run if a required variable is missing.
• API request bodies are validated against explicit schemas before a handler sees them, with size limits on every route that accepts input.
• Errors are reported to an error-monitoring service with technical context. Application logs record counts, durations, and error codes rather than the contents of your files or datasets.
• Production database migrations cannot be applied by a development server. That path is blocked deliberately, after it turned out to be possible.

• Rate limits on contact submissions, AI generations, uploads, document generation, and public API routes.
• The contact form combines spam scoring, duplicate detection, a honeypot field, timing signals, and Cloudflare Turnstile where it is configured.
• Uploads are constrained by file type, file size, row and page counts, and per-plan quotas — all enforced server-side.
• Plan quotas are reserved before work starts and finalised against what was actually produced, so a job cannot quietly exceed its allowance mid-run.

Parts of the platform run on infrastructure operated by others. Each provider has its own security posture, and our controls do not extend inside their systems.

Providers marked conditional are used only in specific circumstances — with your consent, on a labelled AI action, or when configured for a particular deployment. The Privacy Policy explains what each means for your data.

Motifuse is built and maintained by one person. Being straightforward about what that does and does not buy you is more useful than a page of reassuring adjectives.

• No certifications. Motifuse is not ISO 27001 certified, not SOC 2 audited, and not PCI DSS certified in its own right — card data is handled by Razorpay precisely so that it does not need to be.
• No compliance attestation. This is not a HIPAA-covered service, and we claim no GDPR certification, which does not exist as a formal scheme in any case.
• No third-party penetration test has been commissioned. Security work so far is design review, code-level controls, and fixing what gets reported.
• No uptime guarantee or service-level agreement on any self-service plan.
• No response-time commitment for support or security reports. Reports are read and acted on; we will not publish a number we have not measured.
• No paid bug bounty programme.
• No end-to-end encryption. Files in cloud processing are encrypted in transit and at rest by the storage provider, but the service can read them — that is what processing them requires.
• Malware scanning covers SpecTrace uploads only, as described above.

If your work requires any of the above, Motifuse cloud processing is probably not the right tool for it today — though the browser-mode products may well be, precisely because nothing leaves your device.

Email security@motifuse.com, or use the contact form and choose the security category. Please include the affected URL, the impact, reproduction steps, and the browser or tool involved.

Good-faith reports are welcome and prioritised. We will not pursue action against research conducted within these boundaries.

Some risks are only addressable at your end. Saying so is part of the security model, not a disclaimer bolted onto it:

• Do not paste passwords, private keys, API tokens, or recovery phrases into any online tool, including ours.
• On a shared or public device, sign out and clear site data — local drafts are stored in the browser by design.
• Review generated documents, code, and AI-assisted text before sending them anywhere that matters.
• Keep your browser and operating system updated. Browser-mode processing runs on your device and inherits its security.
• Treat sign-in links as credentials: anyone holding one can use it within its 20-minute window.