Security

Imato is built on a small, auditable stack, and your designs are never used to train AI models.

Transit + storage

Everything flows over TLS 1.2+. Uploads and renders live in non-listable storage and are served from long, unguessable URLs — only people you share a link with can open a file. Deleting a translation removes its stored images. Database + object storage volumes are backed up daily and mirrored offsite.

AI provider data handling

We use Google Gemini models, accessed through OpenRouter, to understand the layout of your graphics and translate their text. Image processing runs on dedicated GPU workers. Your images and translations are only processed to produce your outputs, and we never use them to train models.

Accounts + auth

Sign in with Google or an email magic-link — no passwords stored on our end. Session tokens live in httpOnly cookies; access tokens expire after 15 minutes and are refreshed automatically. Card details are handled by Stripe and never touch our servers.

Responsible disclosure

Found a vulnerability? security@imato.ai. We'll acknowledge within 48 hours and credit you publicly once it's fixed.