Security & your data

Splatverse can train on your own GPU without uploading a single byte of footage. You register the files where they already live; the platform stores only their path, size and a fingerprint, and your machine reads them locally when a run starts.

This is the strongest privacy option we can offer, and it is a normal way to use the platform rather than a special mode — training on your own hardware also costs no credits, always.

Every request resolves through a single authentication point that establishes which project you are acting in and what your role there permits. Every read and every write is then scoped to that project — scenes, footage, runs, datasets, keys and history alike. There is no endpoint that takes an id and returns it without checking it belongs to you.

API keys are bound to exactly one project and cannot reach another. A machine you connect can only ever be given your own jobs.

Publishing is a deliberate act, and it is the only thing that makes a scene public. Before that, a scene — and its preview image — is reachable only by members of its project. Anyone else gets the same response as a scene that doesn't exist, so an id reveals nothing.

A project has an owner and members, and a member's role decides what they can do: view, edit and clean up, run trainings, or administer the project. Roles are checked on the server for every action — the interface hides what you can't do, but the hiding is never the protection.

Every meaningful action in a project is recorded with who did it and when: trainings started, scenes edited and published, footage added or removed, and anything an administrator does to your account — including why. Refused attempts are recorded too, so "why did nothing happen" has an answer.

Passwords are hashed with scrypt — memory-hard, salted per password, and compared in constant time. We never store the password itself.

API keys and machine tokens are stored only as SHA-256 hashes. The real value is shown once, at creation, and cannot be retrieved afterwards — not by you, and not by us.

Links that serve your files are signed and expire after an hour; they are generated per request against an object we have already confirmed is yours.

Footage and scenes are held in object storage reached over TLS, separately from the machines that train them. The machines that run your trainings never hold storage credentials — they receive a signed link for one specific object.

We treat which infrastructure providers we use as commercial detail rather than something the product exposes, so that we can move or add capacity without it affecting you. If your procurement needs that detail, or a data-processing agreement, or a specific region, ask us and we will tell you.

Removing footage from a project deletes the stored bytes immediately.

Deleting a scene takes it out of every surface and unpublishes it, but keeps the underlying data so you can recover it. To have that data destroyed as well, delete it permanently — that removes the stored bytes and cannot be undone.

Your exports are never gated. Trained scenes can be downloaded at any time — including from an account whose subscription has lapsed or been cancelled. Your original footage stays in your account until you remove it; downloading a take back from the Footage page is on its way. What you make stays yours.

If your plan ends, published scenes stay fully live for 90 days and then pause to a still image rather than breaking. Nothing is deleted, and resubscribing restores them immediately.

We hold no security certifications today, and we would rather say so than imply otherwise. If a certification is a requirement for you, tell us — it affects what we prioritise.