Encryption Claims Are Not a Security Audit

Three statements, three different protections

EroLove AI’s public Privacy Policy says data is transmitted over HTTPS, stored on access-restricted servers, passwords are hashed, and backups are encrypted at rest. Those are distinct claims. HTTPS addresses the connection between a browser and a server; it does not explain who can read content after the server receives it. Access restrictions address who or what can reach stored data; the public page does not list the actual roles, audit logs or access-review schedule. Encrypted backups address backup copies; that wording should not be casually rewritten as a verified encryption design for every primary database.

We have not inspected certificates, server configuration, source code, cloud settings, key management, logs, or a penetration-test report. The checked Privacy Policy is a provider statement, not an independent security certification. A privacy-conscious reader should respect the value of the named controls while refusing to treat their existence on paper as proof of a complete, effective security program.

What the statements establish—and what they do not

This is a request list, not an accusation that a control is absent. Publishing every detail of a defense can itself be unwise, so a user may not receive all technical settings. A credible independent assessment could still describe the scope, date, assessor and high-level outcome without exposing secrets.

Add the AI processor boundary

The Privacy Policy also says relevant conversation content goes to third-party AI model processors for replies, images and voice when played. The first-party HTTPS connection is only one leg of that journey. A complete assurance story would describe the processor contracts, transport and retention boundaries between services. The policy says the provider seeks no-training terms where available, which is not an absolute assurance for every model provider. A user should ask about the current provider list and applicable retention terms rather than infer them from the word “encrypted.”

The same reasoning applies to a generated image later selected for public publication. A private storage claim for an image in your chat does not mean every selected copy remains private forever. The policy describes a separate editorial publication path, without account linkage, whose public copies remain after account deletion. Security of storage and rules for publication are related but different questions.

A compact assurance request

Ask for the latest independent security assessment date and scope, whether chat and media storage were covered, whether a processor review was included, and how the company handles reported vulnerabilities. If the provider cannot disclose a report, request a plain-language summary of controls and known limitations. Record the answer and its date. Do not infer a security failure solely from a refusal to reveal sensitive implementation details.

Our verdict: the checked policy names sensible controls, but a list of controls is no substitute for verified operation. For an intimate AI product, the distinction is essential. Neither praise nor condemnation of actual security can rest on a paragraph of provider-authored wording alone.