Security And Privacy
10 articles
How your data is encrypted at rest with AES-GCM
HIIE encrypts project data at rest with AES-GCM using server-only keys, a fresh IV per field, and bucket binding so tampered or mismatched data won't decrypt.
Per-project and per-folder key separation explained
Each project and folder gets a distinct AES-GCM key derived from the master KEK using the bucket id as salt, so one tenant's key can never decrypt another's data.
What 'operator-decryptable' means (and why it isn't end-to-end)
HIIE uses operator-decryptable envelope encryption: the server holds the master key and can decrypt to serve requests. That is not zero-knowledge or end-to-end.
How per-user data isolation prevents cross-tenant access
HIIE scopes every database row to the authenticated owner and reinforces it with per-bucket keys, so one tenant can never read or delete another's data.
Where your data flows for inference and 3D generation (OpenRouter, Meshy, Railway)
Managed prompts route through OpenRouter; 3D generation sends prompts and concept images to Meshy (api.meshy.ai) or runs on a self-hosted build123d service on Railway. BYO keys keep runs on your own account.
Our policy: data is not sold and not used to train third-party models
HIIE commits not to sell your data or use it to train third-party models. This is a policy commitment about data handling, not a cryptographic guarantee.
How BYO keys and secrets are protected and never returned to the browser
BYO provider keys and project secrets are AES-GCM encrypted at rest, used server-side only, and shown to you as masked hints — the raw values never reach the browser.
Our breach-notification commitments (GDPR Articles 33 and 34, US states)
HIIE commits to GDPR Article 33 (72-hour authority notice) and Article 34 (notifying affected individuals), plus California, Wyoming, and Nebraska breach-notification commitments.
Who operates HIIE and how to reach the security team
HIIE is operated by Arthur Labs, Inc., a Wyoming C-Corp based in Omaha, Nebraska. Reach security@, privacy@, or [email protected] depending on your need.
What payment data we store (and why card data lives with Stripe)
HIIE stores no payment card data — Stripe (a PCI-DSS Level 1 provider) handles payments. Bring your own provider key and HIIE itself is free.