Dvido AI Logo
Our multi-layered security architecture protects your creative assets, video transcoding pipelines, API secrets, and identity at every tier of the Divido AI platform.
ENCRYPTION

TLS 1.3 & AES-256

End-to-end data encryption in transit and AES-256-GCM vaulting for custom API provider credentials.

ISOLATION

Queue Worker Isolation

High-load video transcoding and FFmpeg rendering run within isolated background BullMQ workers.

GOVERNANCE

RBAC & JWT Controls

Cryptographically signed tokens and strict server-side role validation for administrative actions.

01. Cryptographic Standards & Data Encryption

A. Data in Transit

All external traffic between user clients and Divido AI is strictly enforced over HTTPS/TLS 1.3 using forward-secret cipher suites. Plain HTTP connections are automatically redirected to encrypted endpoints at the edge.

B. Data at Rest & Credential Vaulting

Sensitive authentication secrets and third-party AI provider keys are stored encrypted at rest using AES-256-GCM with unique cryptographic initialization vectors.

02. Media Processing & Sandbox Worker Isolation

Generative AI video workflows, PowerPoint XML compilation, and speech synthesis require significant computational pipelines. To isolate workloads and prevent collateral impact:

  • Asynchronous Job Queues: Media rendering is partitioned into isolated BullMQ workers backed by Redis. If an invalid or malicious file triggers an error, the worker isolates the fault without affecting web APIs.
  • Strict Subprocess Timeouts: All FFmpeg video transcoding and audio rendering jobs enforce strict execution timeouts to prevent resource exhaustion.
  • Ephemeral Scratch Cleanup: Temporary frames and scratch storage buffers created during video composition are purged immediately after rendering completes.

03. Authentication, Authorization & Sessions

Divido AI safeguards user identity and account resources through zero-trust access principles:

  • User passwords are hashed using bcrypt with adaptive salt work factors; plaintext passwords are never recorded in logs or persistent stores.
  • Session tokens use signed JSON Web Tokens (JWT) adhering to industry best practices for expiration and validation.
  • Administrative endpoints require verified ADMIN roles evaluated server-side by NestJS guards; client-side authentication states are never trusted for permission checks.

04. Threat Mitigation & Rate Limiting

To defend against abusive traffic, denial-of-service, and automated credential stuffing, our infrastructure incorporates:

  • Multi-Tier Throttling: Automated rate limits powered by NestJS ThrottlerGuard on authentication, presentation creation, and video synthesis endpoints.
  • Input Validation & Sanitization: Strict payload schema validation, MIME-type checks for file uploads, and URL sanitization.
  • Injection Defense: Relational database operations utilize parameterized queries executed via Prisma ORM, mitigating SQL injection risks.

05. Responsible Vulnerability Disclosure

We welcome reports from ethical security researchers. If you identify a potential security vulnerability within any Divido AI service:

Guidelines for reporting:

  • Please do not exploit, modify, or access user data without explicit permission.
  • Give our engineering team reasonable time to investigate and patch before making public disclosures.

Email reports directly to: security@divido.ai