Security

Every project, upload and preset belongs to one account, and every request is checked against it. Automated tests check that one account can never read another’s projects.

Files are never served from a public address. The editor reaches your footage through signed links that expire after a few hours.

Transcription and rendering run on your own device, so your audio is not sent to a transcription service and no render server holds copies of your videos.

All traffic is served over HTTPS and passwords are hashed with bcrypt. Payment and sign-in secrets are kept server-side and never shown back in the admin.

Card details are entered in Paddle’s checkout and never touch our servers. Billing webhooks are signed by Paddle and verified before any credit is granted.

Sign-in is rate limited against password guessing. Google sign-in uses state and PKCE checks and reads your profile server-side.

If you find a security issue, write to hello@example.com with the details. Please give us a reasonable time to fix it before disclosing it. We do not take action against good-faith research.