Security

Diraz is an AI technology company, and the platform this page is about is infrastructure other people's products depend on, so a security problem here does not stay contained to us. We design for that: credentials are never stored in a recoverable form, every surface runs behind TLS, and access to production systems is limited to what operating the Service actually requires.

• Passwords are hashed with a modern, salted algorithm and never stored, logged, or transmitted in plain text.
• An API key's secret is shown to you exactly once, at creation. We store only a one-way hash of it — a lost or leaked key can be revoked and reissued, but it cannot be recovered by us, because we never have the plaintext to recover.
• Every surface (marketing, dashboard, and API) is served over HTTPS only.
• Sign-in and sign-up are protected against scripted/automated submission.
• Every API product enforces a published rate limit, and requests are authenticated per key, per organization.

If you believe you've found a security vulnerability in the Service, tell us at [email protected] before disclosing it anywhere else. Include:

• What you found and why you believe it's a vulnerability;
• Steps to reproduce it, and any proof-of-concept you used; and
• What you've already accessed or changed, if anything.

We will acknowledge your report and work with you on a fix and a reasonable disclosure timeline. If you report a good-faith finding through this channel, without accessing data beyond what is needed to demonstrate the issue and without disrupting the Service for others, we will not pursue legal action against you for the research itself.

In scope: Diraz's own infrastructure — the marketing site, the dashboard, and the public API.

Out of scope: the third-party sources a Sourced product reflects (see the Terms of Service) — those are not our infrastructure, and a finding there should go to that source directly. Also out of scope: denial-of-service testing, social engineering, and physical access attempts against us or anyone acting on our behalf.

This policy is also published in the standard RFC 9116 format at /.well-known/security.txt, so a scanner or a researcher's tooling can find it automatically.