TRUST CENTER
Trust starts with boundaries you can verify
This page brings together verifiable facts about data handling, result access, idempotency, billing and service state. Each statement keeps its scope and never presents testing evidence as a production promise.
Snapshot generated: 11/11/2026Production service available
3hshared result-access window
1image-task endpoint
0platform API keys in public result URLs
Best Effortcurrent service level, not a production SLA
01Input and result assets
Input images and masks are private temporary assets used for asynchronous execution and restart recovery. Upstream results count as delivered only after download, decode, MIME, size and integrity validation; unverified upstream URLs are never returned directly.
All results from one successful task share a single completed_at + 3-hour deadline. Task queries can re-sign access within that window but never extend it; the server automatically removes image content at expiry while contract-defined metadata and actual dimensions remain.
Keys and access boundaries
Public task APIs use OGA bearer API keys. The server stores a digest for verification; API keys never enter result URLs, public pages or model snapshots. Result URLs bind the account, task, asset, representation and fixed expiry.
The user console and admin surface share brand styling but retain separate sessions, cookies, CSRF controls and permission APIs; visual consistency does not merge identity.
Pricing, settlement and refunds
Public pages use prices only from active, routable catalog routes. Task creation locks candidate pricing and route terms, then settlement uses the final route's per-request price—without per-image price multiplication or silent repricing.
Zero delivery, policy violation and unrecoverable outcomes follow the locked structured refund policy. Public rules are shown, while non-routable routes do not expose pricing or refund detail.
Task reliability and observability
All upstream work starts from a durable task. A synchronous timeout only changes the same task to asynchronous polling; unknown acceptance is never automatically resubmitted or switched. With an Idempotency-Key, the same canonical request returns the existing task and a different request conflicts.
Model pages pair metrics with sample count, sampling time and update time so one test is not presented as long-term reliability. Unknown service state stays unknown rather than falling back to green.
BOUNDARIES WE DO NOT HIDE
Production, payment and signup gates are open
Pages, robots, sitemap and conversion actions share one release snapshot. The selected route price is still locked at task creation.
