# Demosmith security

Markdown version of https://demosmith.ai/security for AI assistants and other readers.
Last updated: 2026-10-28.

How Demosmith protects your product login, your demos and your account. To
make a demo, Demosmith signs in to your product and records what it sees. This
page says what it does with that access and with everything it captures.

Running a security review or filling in a questionnaire? Book a call or email
sales@demosmith.ai.

## Your product login

- The login you give is used only to run the demos you ask for.
- After you enter it, the app never shows it again. It appears as ***.
- While a demo runs, the login is replaced with [redacted] in the activity
  feed and in anything the AI checks are given to read.
- Put your login in the login fields, not in your prompt. A password typed into
  the prompt looks like ordinary text, so it cannot be hidden.

## Codes and sign-in steps during a run

If your product asks for a two-factor code or another sign-in step partway
through, Demosmith pauses and asks you for it.

- Your answer is held in temporary memory, read once, then deleted.
- If it is never used, it expires on its own.
- It is never saved with your demo and never sent to an AI model.

## What ends up in your demos

- A demo shows the screens Demosmith visits, so use sample data for anything
  you would not want a viewer to see.
- Before an interactive demo goes live, sensitive form fields are blanked:
  passwords, security codes, card and bank details, ID numbers, email
  addresses, phone numbers, home addresses and similar.
- Only people with the link can see a shared demo. It goes in the public
  gallery only if you choose to list it.
- When you delete a demo, its links stop working right away, and it is deleted
  from Demosmith's systems within 30 days.

## Encryption

Data is encrypted in transit and at rest. The app accepts secure connections
only, and browsers are told never to connect over plain HTTP.

## Your account and payments

- Sign in with Google, or with an email and password. Passwords that are too
  short, too common or all numbers are rejected.
- Payments go through a third-party payment processor. Demosmith never sees or
  stores your full card number.

## AI and your data

Demosmith does not train or fine-tune AI models on your data, and the AI
providers it works with do not train on it either.

## Privacy laws

You have rights over your data under the EU and UK GDPR, Canada's PIPEDA and
California's CCPA, including access, correction and deletion. Data may be
processed in the United States and other countries. Details:
https://demosmith.ai/privacy

## Security reviews

Demosmith helps teams with security questionnaires and vendor reviews. It does
not hold a SOC 2 or ISO 27001 certificate yet. Book a call to go through how
something is handled.

## Reporting a security issue

Email support@demosmith.ai with "Security" in the subject line, and allow time
for a fix before sharing it publicly.