Security at Guidejar
How we store and protect customer data. If you have a question that is not answered here, contact us at [email protected].
Infrastructure
Guidejar does not operate its own physical servers. The service runs on established cloud providers, each independently certified against recognized security standards. Certification reports are available from the providers directly.
Google Cloud Platform
Application database (Firestore), authentication, backend functions, and media processing (Cloud Run, US region).
SOC 2 · ISO/IEC 27001
Vercel
Web application hosting and edge caching.
SOC 2 Type II
Cloudflare
Storage and delivery of uploaded media — screenshots, recordings, audio — via R2 and the Cloudflare CDN.
SOC 2 · ISO/IEC 27001
Amazon Web Services
Video export rendering (US region).
SOC 2 · ISO/IEC 27001
Encryption
All traffic between your browser and Guidejar, and between Guidejar and its service providers, is encrypted in transit using TLS (HTTPS). Data stored with our infrastructure providers — Google Cloud, Cloudflare, and AWS — is encrypted at rest by those providers by default.
Sensitive values that Guidejar stores on your behalf — such as API keys you connect for bring-your-own-key AI features, single sign-on secrets, and share-link passwords — are additionally encrypted at the application level (AES) before being written to the database.
Payments
All payments are processed by Stripe, a PCI DSS Level 1 certified payment processor. Checkout happens on Stripe-hosted pages, and your card details never touch Guidejar's servers. Guidejar does not store credit card numbers.
Access control
Authentication is handled by Firebase Authentication. Guidejar supports sign-in with email and password (with mandatory email verification), Google, and SAML-based enterprise single sign-on.
Workspace roles
Each team member has a role — owner, admin, creator, or viewer — that determines what they can create, edit, and manage. Role checks are enforced on the server, not just in the interface.
Guide-level sharing
Guides can be private, restricted to your team, shared with specific people by email, or public. Share links can additionally be password protected.
API authentication
Every authenticated API request is verified server-side against a short-lived identity token. Internal service-to-service calls use Google-signed identity tokens. API keys are stored as salted hashes, not in plain text.
Abuse prevention
Sensitive endpoints — uploads, AI generation, contact forms — are rate limited per user to prevent abuse.
Data retention and deletion
- Deleted guides are moved to trash, where they can be restored for 30 days. After 30 days they are permanently deleted from the application database.
- Rendered video exports are automatically deleted from storage a few days after rendering.
- Cloned AI voices that have been unused for 60 days are deleted from our voice provider.
- When you delete your account, your user profile is permanently removed and you are unsubscribed from our email systems. To request deletion of remaining content or a copy of your data, contact [email protected].
Subprocessors
Guidejar uses the following third-party services to operate the product. This list is also maintained at guidejar.com/subprocessors.
| Name | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Cloud Infrastructure & Data storage | United States |
| Vercel | Frontend hosting & Redis Caching | United States |
| Cloudflare | File storage and CDN | United States |
| Amazon Web Services | Video export rendering | United States |
| OpenAI | AI features (guide rewrite, video to guide etc.) | United States |
| Sentry | Error monitoring | United States |
| Elevenlabs | AI voice generation | United States |
| Tinybird | Analytical database | Europe |
| Algolia | Full Text Search | Europe |
| Stripe | Payment processing | United States |
| Posthog | Product analytics | United States |
| Google Analytics | Website traffic and usage analytics | United States |
| Autosend | Email sending | United States |
| Crisp | Customer support | United States |
| Dub | Referral tracking | United States |
If you connect your own API keys (for example OpenAI, Anthropic, or ElevenLabs), requests using those keys go directly to that provider under your own agreement with them, and your keys are stored encrypted.
Compliance
Guidejar supports GDPR rights for access, correction, deletion, and export of personal data — see our GDPR page for details. A Data Processing Agreement is available at guidejar.com/dpa. SOC 2 certification for Guidejar itself is on our roadmap; in the meantime, our infrastructure providers listed above hold SOC 2 and ISO/IEC 27001 certifications.
Incident response
If a security incident affects your data, we notify affected customers without undue delay — and within 72 hours for personal data breaches, in line with GDPR — including what happened, what data was involved, and what we are doing about it.
Reporting a vulnerability
If you believe you have found a security vulnerability in Guidejar, please email [email protected] with a description of the issue and steps to reproduce it. We respond to vulnerability reports within 72 hours. Please do not access other users' data or disrupt the service while testing.