Security and Data Handling

Demo Tool AI makes product demo videos by operating your product in a cloud browser. That means you trust us with a URL, sometimes a test account, and the recordings we make. This page explains how we handle each of them. The legal version is our Privacy Policy.

Test accounts

• Encrypted at rest. A test account you add is encrypted before it is stored. There is no unencrypted copy.
• The AI never sees the password. The agent plans its steps with placeholders such as {{password}}. The real value is filled in only at the moment of typing, inside the browser.
• Kept out of scripts and narration. Passwords and verification codes are removed from everything the agent writes, so they can't end up in the storyboard, the voiceover or the captions.
• Signed in off camera. Login steps happen before recording starts. The signed-in browser session is encrypted and kept with the account.
• Deleted after 7 days. The account and its saved session are deleted 7 days after you add them, or sooner when you remove them or delete the demo.
• Codes are used once. A verification code you type while the agent waits is used for that step and not kept.

Please use a test account with sample data, never an admin or a personal account.

What the agent can and can't do

Two limits are enforced in code, whatever the AI decides:

• It can't reach private networks. All browser traffic goes through a filter that refuses local, internal and cloud metadata addresses, so a URL can't be used to reach our systems, or yours behind a firewall. This is also why localhost URLs don't work.
• It can't jump to another site. When it navigates by address, any URL outside the site you gave it is refused.

The agent also follows these rules on every step:

• It doesn't delete data, send messages to real people, buy anything or change billing.
• It doesn't submit sign-up, contact or checkout forms unless the demo is about that flow. Showing a form and typing sample data is fine.
• If it gets stuck on a CAPTCHA or needs a code, it stops and asks you instead of guessing.

Where each demo runs

Each demo runs in its own short-lived cloud container on Google Cloud. The container's browser, files and memory are thrown away when the job ends. Finished videos are uploaded to private storage, and temporary files are deleted.

Your videos

• Demos are private to your account.
• Others can watch one only if you create a share link or an embed code. Links use long random tokens, and you can turn them off at any time.
• Videos stay until you delete them or close your account.
• We don't use your product's pages, recordings or videos to train AI models.

Payments

Payments are processed by Stripe. We never see or store your full card number.

Who processes data for us

Cloudflare (hosting, storage, email), Google Cloud (cloud browsers and rendering), Anthropic (the AI that operates the browser and writes the script, directly or through API resellers), ElevenLabs (voiceovers), Stripe (payments) and pvuv.ai (analytics without names or emails). Each gets only what it needs for its part. See the Privacy Policy for details.

Certifications

We're a small team and don't have a SOC 2 or ISO 27001 report yet. If your company needs a security questionnaire answered, email us and we'll answer it honestly.

Reporting a problem

If you think you've found a security issue, email support@demotoolai.com with the details. Please don't test against other users' accounts or data. We'll reply within a few working days.