Security & Responsible Disclosure

What "self-hosted" means here

When you buy a Ghostlight or Alethyra source kit, or a commissioned build, you deploy it on your own infrastructure — typically your own Railway account, sometimes a local machine or your own server. Sirenwave Studios does not operate, host, or have standing access to your running companion, its conversation history, or its memory store. There is no central "Sirenwave cloud" holding customer companion data.

Customer API keys

Your model provider key (e.g. OpenRouter), voice provider key (e.g. ElevenLabs, Fish Audio), and any other third-party credentials belong to you, are entered directly into your own deployment's environment configuration, and are never collected, transmitted to, or stored by this website. Sirenwave Studios has no visibility into your API usage or keys.

Railway and local deployments

Whether you deploy to your own Railway project or run locally, the account, the server, the environment variables, and the data on it are yours to secure. See Getting Started for the setup process and Self-Hosted Deployment Notice for the full boundary of what that means.

Relationship isolation

Each customer's deployment is independent. Ghostlight and Alethyra source kits do not share a memory store, database, or companion state across customers — your instance only knows what happens inside your own deployment.

No public deployment snapshots or backups

Sirenwave Studios does not publish, host, or distribute pre-built container snapshots, database dumps, or backups of any customer or reference deployment. Setup happens from the documented source kit and your own accounts — not from a shared image containing anyone's data. For Alethyra specifically, Alethyra Licensing carries a fuller notice covering private Railway deployment artifacts — what's covered, what's prohibited without written authorization, and how to report one you've encountered by accident.

No accounts, no login

This website has no user accounts, no login system, and no admin panel reachable from the public internet. There is nothing here to phish a password for, because there are no passwords.

Custom Build requests

The "Build Your Companion" configurator sends your enquiry to a private Discord channel via a server-side webhook (or, if that isn't configured, falls back to opening a plain email). The request isn't written to a database — this site doesn't have one.

Newsletter

When enabled, the newsletter signup is handled entirely by MailerLite, a third-party email service — subscriber emails go directly to MailerLite, not to a Sirenwave-run database. See the Privacy Policy for details.

Purchases

All payments are handled by Ko-Fi, Patreon, and (where offered) Stripe or PayPal directly — this website does not process or store payment card details itself.

How to report

If you believe you've found a security vulnerability in a Sirenwave website or a distributed Ghostlight or Alethyra source kit, please report it privately to hello@sirenstudios.tech before disclosing it publicly. A dedicated security@ address may be set up as the studio grows — until then, this is the right inbox. Include enough detail to reproduce the issue: affected URL or file, steps, and impact.

What to expect

• We'll acknowledge genuine, good-faith reports and work to understand and fix the issue.
• No bounty is currently offered — this is an independent studio, not a program with a payout budget.
• Please don't access, modify, delete, or exfiltrate data beyond what's strictly necessary to demonstrate the issue.
• Please give us reasonable time to investigate and remediate before any public disclosure.
• Vulnerabilities in third-party platforms we use (Railway, Discord, Ko-Fi, Patreon, MailerLite, model/voice providers, etc.) should be reported to that provider directly, not to us — unless the issue is specifically in how our code integrates with them.

Updates and patching

Fixes to this website ship as normal commits and deploys. Fixes to distributed Ghostlight and Alethyra source kits are noted in the Development Log and, where a change matters for security, called out explicitly rather than buried in a generic changelog line.