Security at Pixeltable
How we authenticate access, host Pixeltable Cloud, and handle Customer Content.
Authentication
Pixeltable Cloud uses WorkOS AuthKit for sign-in (email and social login). Organization administrators control who can access an organization. API keys and runtime secrets are created and revoked by the customer; we do not claim SSO, SAML, or SCIM unless those are part of a separate Enterprise arrangement.
Infrastructure
Pixeltable Cloud runs on Amazon Web Services in us-east-1 (including EKS, Lambda, and object storage). The website and application layer are hosted on Vercel. DNS, CDN, and routing for pxt.run use Cloudflare. We do not operate production Cloud on GCP or Azure today.
Encryption
Data in transit is protected with TLS. Data at rest is encrypted using the encryption provided by our cloud infrastructure providers.
Customer data and secrets
You own Customer Content stored in Pixeltable Cloud. We process it to provide, secure, and support the service, not to train Pixeltable models by default. Organization admins are responsible for API keys and secrets. Support or operations may access Customer Content only as needed to operate, secure, or troubleshoot the service. See our Terms of Service and Privacy Policy.
Subprocessors
We use named vendors to run Cloud, including WorkOS, Stripe, AWS, Vercel, Cloudflare, CockroachDB, Resend, and Groq (in-product help chat). The current list and roles are in our Privacy Policy. Enterprise customers may request a data processing agreement via our contact page.
Service status
Live component status and incident notes are published at pixeltable.com/status. This page does not constitute an uptime SLA unless an Enterprise order form says otherwise.
Vulnerability disclosure
If you believe you have found a security vulnerability, email security@pixeltable.com. Please include enough detail for us to reproduce the issue. We do not currently operate a paid bug-bounty program.
Last updated: August 15, 2026