Security Policy
Effective Date: September 26, 2026
This Security Policy describes how CreatoRain (operated by Midwest AI Solution Inc.) protects the CreatoRain platform, our clients' data, and the personal information of creators and other users. Everything on this page describes a measure that is in place today.
1. Hosting
The CreatoRain platform runs on Amazon Web Services (AWS) in the United States. AWS is responsible for the physical security of its data centers, which are covered by AWS's own SOC 2 and ISO 27001 audits. Those audits cover AWS's infrastructure, not CreatoRain's own practices.
2. Encryption
2.1 In Transit
Connections to our website (www.creatorain.com), the app (app.creatorain.com), and our API use TLS 1.2 or later, and older versions of TLS are refused. The website and the app also support TLS 1.3. Our API sends an HTTP Strict Transport Security (HSTS) header, so browsers reach it only over HTTPS.
2.2 At Rest
The production database is encrypted at rest with a key held in AWS Key Management Service (KMS), which AWS rotates automatically. Files we store in Amazon S3 are encrypted at rest with AES-256. Database backups are encrypted in the same way as the database.
3. Backups
The production database is backed up automatically every day and can be restored to any point in time within the last 35 days. Backups are kept in the same AWS region as the database. We tested a full restore from backup in August 2026.
4. Sign-In and Access
- Clients and creators sign in through Amazon Cognito, and our API checks the signed token that comes with each signed-in request.
- Partner API integrations (early access) authenticate with API keys issued by CreatoRain. A key is shown once when it is issued and stored only as a hash, and it can be limited to a list of IP addresses.
- Sign-in and sign-up are rate-limited to slow down password guessing.
- Access to production systems and data is limited to the personnel who operate the platform.
5. Monitoring
AWS CloudTrail records administrative activity on our AWS account in every AWS region, and Amazon GuardDuty watches the account for signs of compromise.
6. Changes to the Platform
We make code changes through pull requests, which run automated builds and tests before they are merged.
7. Incident Response
If we detect a security incident, we contain it, investigate its scope and cause, fix the underlying problem, and record what happened and what we changed.
If a security incident affects personal data or client data, CreatoRain will notify affected clients without undue delay and in any event within seventy-two (72) hours of becoming aware of it, as our Data Processing Agreement sets out. The notice will describe what happened and the types of data affected, what CreatoRain has done to contain and fix the problem, steps affected parties can take to protect themselves, and how to reach us. CreatoRain will also notify regulators where data protection law, including the GDPR and the CCPA, requires it.
8. Privacy Law
8.1 Privacy Laws
CreatoRain's Data Processing Agreement (DPA) forms part of every Client Agreement and covers processing under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). Requests about CreatoRain's own processing go to privacy@creatorain.com; requests about data CreatoRain processes for a client are handled as the DPA describes.
8.2 CCPA
CreatoRain provides the disclosures that the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), requires, and honors requests to access, correct, or delete personal information sent to privacy@creatorain.com. Restaurants pay to use our Services, and our Services give them access to the creator information we hold, including contact details. Anyone who asks for a free creator list on our website gives us their contact details and receives creators' public profile information and our estimate of each creator's likely gender. Our Privacy Policy describes both. Apart from these, CreatoRain does not sell personal information, and does not share it for cross-context behavioral advertising.
9. Service Providers
CreatoRain uses the service providers listed on our Subprocessors page to run the platform. We email clients at least thirty (30) days before adding a new one, as our Data Processing Agreement describes. We share with each provider only the data it needs to do its job. Clients who object to a new provider can do so as our Subprocessors page describes.
10. Contact the Security Team
If you have questions about CreatoRain's security practices, would like to report a security vulnerability, or need to report a suspected security incident, please contact our security team:
CreatoRain Security Team
Email: security@creatorain.com
For responsible disclosure of security vulnerabilities, please email security@creatorain.com with a detailed description of the vulnerability, steps to reproduce it, and any supporting evidence. We ask that you allow us a reasonable period to investigate and address the issue before making any public disclosure. CreatoRain does not pursue legal action against security researchers who report vulnerabilities in good faith and in accordance with responsible disclosure practices.
For general security inquiries, Scale Plan clients may also reach out through their dedicated CreatoRain account manager.