PaintBox

Security and privacy

Security and privacy: what is true today, and what is not yet.

Every line on this page comes from PaintBox’s code and configuration, or from a public Bike4Mind page we link. Where something is not done, we say so.

Where your images live

By default, in your browser. They reach our servers only once you sign in.

  • In your browser first. The editor keeps your documents in your browser’s own storage (OPFS and IndexedDB). Signed out, it sends no pixels to our servers: every route that takes an image needs a signed-in account.
  • Backed up when you sign in. Signed in, the editor copies its autosaved snapshots of each document to PaintBox’s servers, so your work survives your browser clearing its storage. At most one copy per document every five minutes, the 5 most recent kept. Backups count toward your plan’s cloud storage (100 MB on Free; until plan quotas switch on, every account gets 2 GB). You get a warning at 80% and at 100%; when it is full, new backups pause and nothing stored is deleted.
  • Private storage in the US. Files on our servers are kept in private Amazon S3 buckets in AWS us-east-2 (Ohio). No bucket is public: your browser reaches a file only through a short-lived signed link the server issues to its owner.
  • Encryption. Every connection to PaintBox is HTTPS. At rest, files are encrypted by Amazon S3’s default server-side encryption, with keys AWS manages. We have not set up our own encryption keys.AWS: default encryption for S3
  • Deleting your account. Account, then Delete Account, removes your files, backups, published links and records. Two things are kept: the audit log and the spend ledger, which name the account only by an internal id.
  • Inactive accounts. If you don’t sign in for 12 months, we email you, then delete your stored files 30 days later.Coming soon

Signing in

You sign in with a Bike4Mind account. PaintBox never sees your password.

  • Bike4Mind sign-in. Sign In sends the whole page to Bike4Mind’s sign-in, through Amazon Cognito, and back. It uses the OAuth authorization code flow with PKCE (S256) and a state check, so a sign-in cannot be finished by anyone but the browser that started it.
  • Tokens out of reach. Your access token lives in that browser tab only and expires after 15 minutes. The token that renews it is in a cookie page scripts cannot read (HttpOnly, Secure, SameSite=Strict, sent only to the sign-in routes). It changes on every use, and if a spent one is used again, that session is signed out.
  • No AI keys in your browser. Our server gets a Bike4Mind key for your account and keeps it there. Your browser never holds a key to Bike4Mind or to any AI provider.
  • Multi-factor and single sign-on. These are set on your Bike4Mind account. Bike4Mind’s security page says it supports multi-factor authentication with an authenticator app or a passkey, and single sign-on through Okta or another SAML 2.0 identity provider.Bike4Mind security

PaintBox and Bike4Mind: what goes where

PaintBox is the editor. Bike4Mind is the AI service it signs you in with, takes credits from, and sends AI work through. Here is what each one holds.

  • In your browser. Your documents, every hand edit and background removal. Signed out, that is all there is: no account and no copy on any server.
  • On PaintBox’s servers. Once you sign in: backups of your documents, the pictures and masks an AI job needs, AI results, agents’ proposals waiting for you, and published review images. Files sit in private Amazon S3 in AWS us-east-2 (Ohio), each at most 64 MB. Records about them (document names, proposals, approved agents) are in a MongoDB Atlas database reached over a private network link from that AWS account; its region is not set in our code, so ask us if you need it.
  • Sent to Bike4Mind for an AI job. A flattened copy of your picture, as a link that expires after 15 minutes (or a smaller copy when the full one is too large for the model), the mask for the area to change, and your prompt. Bike4Mind passes them to the model provider doing that step, and PaintBox copies the result back into its own storage.
  • Kept by Bike4Mind. The job runs on your own Bike4Mind account, which records it, with its result, in a session there, and charges its credits. Bike4Mind deletes the uploaded mask once the edit finishes. Bike4Mind runs on AWS in us-east-2 (Ohio). How long it keeps a job’s result and records is set by Bike4Mind’s privacy policy, not by PaintBox; ask us if you need a number.Bike4Mind privacy policy
  • Never sent anywhere. Your Bike4Mind password (sign-in happens on Bike4Mind’s page), and any picture you only edit by hand while signed out.

Agents

Agents connect to the MCP server with standard OAuth and, by default, can only propose.

  • Standard OAuth 2.1. The MCP server at /api/mcp is protected by OAuth 2.1 with PKCE (S256). Agents find it from the metadata at /.well-known/oauth-protected-resource/api/mcp (RFC 9728) and /.well-known/oauth-authorization-server (RFC 8414). You approve every agent on a consent page, signed in as yourself.
  • Propose, then you approve. Every agent gets the propose scope: it can read your documents, upload images and send you proposals to review. It cannot change a document by itself.
  • More only if you tick it. On the consent page you can also grant edit (change documents without your review) or generate (spend your credits, up to a daily cap you set: $2 unless you change it, $100 at most). An agent may ask for them; the consent page shows each one, and you can untick it before you approve.
  • What an agent can never do. An agent’s token is refused for publishing, for managing your account, and for accepting or rejecting proposals. Those need you, signed in at a browser.
  • Paid work needs your tick. When an agent with only the propose scope asks for an AI image job, its proposal shows the estimated cost, and the job runs on your credits only if you tick it and press Accept. Its other edits cost no credits.
  • Short-lived tokens. An agent’s access token lasts 15 minutes and is renewed with a refresh token that changes on every use.
  • Rate limits. /api/mcp accepts 120 requests a minute from one IP address, and says so in RateLimit-Policy and RateLimit headers; past that it answers 429 with Retry-After. The count is kept by each server instance, so it is a best-effort limit, not an exact global one.
  • Revoke at any time. Account, then Connected Agents, lists every agent you approved; revoking one takes effect on its next request. An agent unused for 30 days loses access, and signing out everywhere revokes them all.

Voice

Voice is transcribed in the cloud, not in your browser.

  • Push to talk. The microphone records only while you hold the talk button, and the editor shows when it is listening. There is no always-on listening. Voice needs you to be signed in, and a clip is at most 5 MB.
  • Where it is transcribed. Your clip goes to PaintBox’s server, which passes it to Bike4Mind’s speech-to-text in AWS us-east-2. Bike4Mind sends it to the speech model its operators have chosen: its code supports OpenAI’s transcription API and Amazon Transcribe, and both appear on its list of sub-processors. Which one is switched on is an admin setting, not something in the code, so ask us if you need to know.Bike4Mind sub-processors
  • Not kept. Audio is not retained after transcription. PaintBox forwards the clip and keeps nothing: no copy, no log line, no database row. Bike4Mind deletes the uploaded audio once transcription finishes, whether or not it succeeded.
  • Uses credits. Bike4Mind charges your account a few credits for each clip, priced by the clip’s size.

AI requests

Only when you ask for AI does anything go to a model.

  • Manual work stays local. Every manual tool, and background removal, runs in your browser. They never send your image to a model.
  • Bike4Mind is the only cloud AI provider. When you ask for AI, PaintBox’s server sends the request to Bike4Mind, which passes it to the model provider doing that step (Anthropic, OpenAI, Google or Black Forest Labs, for example).How AI works in PaintBox
  • Not used for training. Bike4Mind’s security page says: “Bike4Mind does not use your content or your usage to train or improve AI models.” It also says prompts sent to third-party models are processed under those providers’ API terms, which exclude training on your content.Bike4Mind security

What Publish does

Publish turns the variants you pick into a review link. Your document stays private.

  • What becomes visible. File, then Publish, renders a flat PNG of each variant you pick and uploads it. The link shows those images, their labels, a summary of how they differ, your title and note, and the reviewer actions you allowed. Your layered document is not published, and publishing leaves it exactly as it was.
  • Who can see it. Anyone with the link, which has the form /r/<token> with a long random token. Add a passphrase and the server checks it before showing anything, with repeated wrong guesses blocked. Review pages ask search engines not to index them.
  • Taking it back. From the Publish panel you can revoke a link, or replace it with a new one, at any time; the old link stops working at once. Nobody can recall a copy someone already saved.
  • Signed-in people only. Publishing needs a signed-in account at a browser. Agents cannot publish.
  • Checked before it goes public. Published work will pass Bike4Mind’s moderation before anyone else can see it.Coming soon
  • Report and takedown. Every shared page will carry a Report button, with a takedown and DMCA process behind it.Coming soon

Free credit eligibility checks

Free AI credits come from Bike4Mind, which checks a few things first so they go to real people. No card is needed.

  • A verified email. Free credits start when you verify your email. An unverified account gets none.
  • Once per inbox. The free grant is given once per email inbox. A second account on an alias of the same address does not get it again.
  • Paid out over time. New accounts get their free credits in steps, not all at once. Automated checks on new sign-ups can hold credits back, and when many people sign up on one day, a grant can wait until a later day.
  • A daily limit. Bike4Mind can also cap how many credits a free account spends in a day.Pricing and free credits

Web security

The headers every PaintBox page is served with, live today.

  • HTTPS only. Plain http is redirected to https, and PaintBox pages carry Strict-Transport-Security for one year, so browsers stop trying http at all.
  • A strict content policy in the editor. The editor is served with an enforced Content-Security-Policy: scripts only from PaintBox itself (plus WebAssembly), from Google’s tag server for Google Analytics and from Meta and Reddit for their ad pixels, no inline scripts, no eval, no plugins. These marketing pages send only the framing rule.
  • No framing by other sites. frame-ancestors and X-Frame-Options stop other sites from embedding PaintBox; the agent consent page and review links refuse to be framed at all.
  • Locked-down browser features. X-Content-Type-Options: nosniff on every response, a strict-origin-when-cross-origin Referrer-Policy, and a Permissions-Policy that allows the microphone, clipboard and fullscreen for PaintBox alone and turns off the camera, location, payments, USB and the rest.
  • Outside scripts from Google, Meta and Reddit only. On the live site, PaintBox loads Google Analytics (gtag.js) and the Meta and Reddit ad pixels, and no other outside script; the editor’s content policy blocks any other. Outside the US they load only after you allow them; in the US they load unless you turn them off under Cookie settings. The editor’s own diagnostics go to PaintBox’s server and never include your chat with the assistant.
  • Our own analytics, plus Google Analytics and two ad pixels. PaintBox counts visits and a few product events (the editor opened, a file exported, a document saved or published) through its own server, which passes them to Overwatch, Bike4Mind’s own analytics service: one 30-minute visit cookie, and no email, name or IP address in any event. Where Google Analytics is on, Google also receives page views and those events, with its own cookies. Where the ad pixels are on, Meta and Reddit receive page views and two events, an account created and a first accepted AI edit, with their own cookies. None of them gets your images, prompts, file names or email address.PaintBox privacy policy

Report a vulnerability

If you find a security problem, tell us. Please don’t test against other people’s accounts or data.

Compliance, stated plainly

PaintBox is young. Here is where it stands.

  • No SOC 2 report yet. PaintBox has no SOC 2 report, no ISO 27001 certification, and no third-party penetration test report to share.
  • Not for health data. PaintBox has not been assessed for HIPAA. Please don’t put protected health information in it.
  • A PaintBox privacy policy. PaintBox’s own privacy policy says what its own analytics, Google Analytics and the Meta and Reddit ad pixels collect, the cookies they set, who sees the data, and how to turn Google Analytics and the pixels off. Everything that goes through Bike4Mind is covered by Bike4Mind’s policies, below.PaintBox privacy policy
  • Bike4Mind’s policies. Your sign-in, credits and AI requests go through Bike4Mind, whose security page, privacy policy and terms describe how it handles them, including its list of sub-processors and how to ask for a DPA.Bike4Mind security · Privacy policy · Terms of service

As of 2026-11-09. Questions about this page: info@bike4mind.com. See also How AI works and Pricing.