Security at TextSight.

Overview

TextSight is operated by Lacewing Technologies. We're a focused team, so we keep our security posture simple, transparent, and honest: we describe what we actually do, and we use measured language rather than marketing superlatives. This page explains the controls in place today. If something on this page isn't clear, email security@textsight.ai.

Data encryption

In transit

All connections to TextSight — the web app, the marketing site, and our APIs — are served over HTTPS/TLS. We enforce HTTP Strict Transport Security (HSTS) so browsers always connect over an encrypted channel, and all traffic is fronted by Cloudflare for TLS termination and edge protection.

At rest

Account data is stored in a managed PostgreSQL database, with Redis used for queues and short-lived job state. Storage volumes are encrypted at rest by our managed-infrastructure providers.

Authentication & account security

• Password hashing — passwords are hashed with bcrypt. We never store, log, or have access to your plain-text password.
• Two-factor authentication (2FA) — you can enable time-based one-time passwords (TOTP) from your account settings for an extra layer of protection.
• Passkeys — passwordless sign-in with passkeys (WebAuthn) is available as an alternative to passwords.
• Session handling — authenticated sessions are managed with secure cookies. If you suspect your account has been compromised, change your password and email security@textsight.ai right away.

Payment security

All payments and subscription billing are handled entirely by Stripe, a PCI-DSS compliant payment processor. Your card details are entered directly into Stripe's secure fields — TextSight never sees or stores your full card number. We only keep the non-sensitive billing metadata Stripe returns to us (such as plan, status, and the last four digits) needed to run your subscription.

How we handle your content

• Free scans are processed transiently — your text is used only long enough to compute a result, and it is not stored or used to train our models.
• Signed-in users' scan history is saved to your account so you can revisit past results. You can delete any saved scan, or your whole history, at any time.
• We do not sell your content, and we do not use it to train detection or generation models.

Infrastructure & hosting

TextSight runs on established, reputable infrastructure providers, each used for a specific purpose:

Our AI-detection model is self-hosted on dedicated servers in the EU (Hetzner) rather than a third-party detection API, which keeps the core detection pipeline under our direct control.

Monitoring & logging

• Error monitoring — we use Sentry to capture and triage application errors.
• Server logs — we keep structured server logs to operate the service, investigate incidents, and detect abuse.
• Product analytics — we use PostHog to understand aggregate product usage and improve the experience.

For what these tools collect and how long we keep it, see our Privacy Policy and Cookie Policy.

Access control

• Least privilege — internal access to systems and data is limited to the people who need it to do their jobs.
• Audit logging — sensitive admin actions are recorded in an audit log.
• Separation of duties — payment data stays within Stripe, and our detection model runs on isolated dedicated servers.

Responsible disclosure / report a vulnerability

We ask that you give us a reasonable opportunity to investigate and fix an issue before any public disclosure, avoid accessing or modifying other users' data, and avoid actions that could degrade the service (such as denial-of-service testing or spam). Acting in good faith under this guidance, we won't pursue action against you for your research.

Your data rights

Security and privacy go together. You can review what data we hold and how we use it, and exercise your rights, through these documents:

• Privacy Policy — what we collect, why, and your GDPR rights.
• Content Handling Policy — exactly what happens to the text you submit.
• Cookie Policy — the cookies we set and how to control them.
• Terms of Service — the rules for using TextSight.

To request access to or deletion of your data, you can delete saved scans and your account from your settings, or email privacy@textsight.ai.

Contact

• Security & vulnerability reports — security@textsight.ai
• Privacy & data requests — privacy@textsight.ai
• General — hello@textsight.ai
• Postal — Lacewing Technologies, Maharashtra, India · GSTIN 27BSZPB5125R1ZW