Security

A plain, honest list of the technical measures we actually run in production — nothing more, nothing less.

1. Malware Scanning Before Upload

Files sent to our upload endpoints are scanned with ClamAV before they are processed by our tools.
A file flagged as malicious is rejected — it never reaches the conversion/editing pipeline.
This scan runs in addition to, not instead of, the file-type and size checks each tool already performs.

2. Encryption in Transit

All traffic to our site is served over TLS (HTTPS) — plain HTTP is not offered.
HTTP Strict Transport Security (HSTS) is enabled, instructing browsers to always connect over HTTPS.

Honesty note: this covers encryption in transit. We do not currently claim disk-level (at-rest) encryption.

3. Abuse & Attack Protection

A Redis-backed rate limiter caps how many requests a user or IP can make to sensitive endpoints in a given window.
State-changing API requests are checked against the page's own origin (CSRF protection) — a request forged from another site is rejected.
Sign-up is protected by Cloudflare Turnstile to slow down automated abuse.

4. Account Security: Two-Factor Authentication

Every account can enable TOTP-based two-factor authentication (2FA) from the account security page.
Enabling 2FA generates one-time recovery codes you can save in case you lose access to your authenticator app.
2FA is optional and free — we recommend enabling it, especially for Pro accounts.

5. Automatic, Permanent File Deletion

Files you upload for conversion or editing are hard-deleted — not archived, not soft-deleted — usually within 24 hours on the free plan, at most within 7 days.
Video Analysis: the source video is deleted as soon as processing finishes; the analysis report itself is kept for 30 days so you can come back to it.
Video Dubbing: the source video is deleted as soon as processing finishes; the dubbed output is kept for 7 days.
We do not review the content of your files, and we do not share them with third parties.

6. Responsible Disclosure

Found a security issue? We would rather hear about it from you first. Please read our Responsible Disclosure Policy and report it privately — do not disclose it publicly before we have had a chance to fix it.

Read the Responsible Disclosure Policy →

7. Contact

Security questions or reports:

Security:[email protected]

security.txt:/.well-known/security.txt