Security & Privacy You Can Verify
Uncensored doesn't mean insecure. Aether ships with full security headers, encrypted storage, a paid bug bounty, and a structural guarantee that your conversations are never used for training.
Privacy at a Glance
How We Protect Your Data
Encryption in Transit
All traffic is encrypted with TLS 1.2+. HSTS is enforced with a one-year max-age and includeSubDomains. No unencrypted connections are accepted.
Encryption at Rest
Database storage is encrypted at rest via the hosting provider's managed encryption. API keys are stored as irreversible hashes — we never see your raw key after creation.
No Training on Conversations
Your conversations are never used to train, fine-tune, or improve AI models. Period. This isn't an opt-out toggle buried in settings — it's a structural guarantee.
Full Security Headers
Every response includes HSTS, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Content-Security-Policy, Permissions-Policy, and Referrer-Policy. We block clickjacking, MIME sniffing, and unauthorized embedding.
Secure Session Management
Session cookies are HttpOnly, Secure, SameSite=Lax, and signed. Sessions can be invalidated server-side at any time. No sensitive data in client-accessible cookies.
Rate Limiting & Abuse Prevention
All endpoints are rate-limited per API key and per IP. Brute-force login attempts are throttled. Credit-consuming endpoints have per-minute and per-day caps based on plan tier.
API Key Security
API keys use cryptographically random generation with a unique prefix (ak_live_). Keys are hashed before storage. Revocation is instant. Per-plan key limits with race condition protection.
SSRF & Input Validation
All user-supplied URLs go through DNS resolution and IP validation before fetch. IPv4-mapped IPv6 bypass is blocked. Redirect hops are validated. Internal network access is prevented.
Payment Security
Card payments processed by Square — we never see card numbers. Crypto payments via NOWPayments with invoice verification and forgery guards. Exactly-once idempotency on all payment processing.
Data Deletion
Request account deletion and all your data — conversations, API keys, memories, payment records — is permanently removed. No 30-day waiting period, no soft-delete that keeps your data around.
Privacy Comparison
| Feature | Aether | ChatGPT | Claude |
|---|---|---|---|
| Data used for training | Never | Default ON (opt-out buried in settings) | Opt-out available |
| Credit card required | No | Yes (for Plus) | Yes (for Pro) |
| Crypto payments | BTC, ETH, USDT, 300+ coins | No | No |
| Security headers | HSTS, CSP, X-Frame-Options, nosniff, Permissions-Policy | HSTS, CSP | HSTS, CSP |
| Bug bounty | Up to $2,000 (crypto payout) | Up to $20,000 | Up to $15,000 |
| Health endpoint info leak | None ({ok, ts} only) | N/A | N/A |
| Account deletion | Immediate | 30-day processing | Request-based |
Content Policy: Five Hard Limits
Aether is uncensored — but uncensored doesn't mean no limits. Five categories are permanently blocked, not by a classifier that false-positives on legitimate use, but as structural hard limits:
Everything else — security research, adult fiction, drug harm reduction, firearms knowledge, controversial political analysis, medical information — is answered directly and without disclaimers.
Questions About Security?
Found a vulnerability? We pay for valid reports. Have a privacy question? Reach out anytime.