Security

• In transit: every connection to the website, the API and storage uses TLS 1.2 or later.
• At rest: the database, backups and ClipnClip Cloud video storage are encrypted at rest by the hosting provider.
• Bucket keys: own-bucket access keys are encrypted with a per-workspace data key, which is itself encrypted with the application key. The API never returns them; you only ever see the last four characters.

Uploads and playback use short-lived presigned URLs. Your browser sends video straight to storage in parts and plays it straight from storage; video bytes do not pass through the ClipnClip API. A share link can additionally require a password, an allowed email domain or an expiry date.

In own-bucket mode your videos are never stored on ClipnClip servers. To transcode and transcribe, a worker reads the video from your bucket into an isolated sandbox without network access, writes the results back to your bucket, and deletes its temporary files when the job ends.

Prefer no processing at all? Switch Server processing off in Settings → Storage; ClipnClip then never reads your video, and features that need processing are turned off.

The desktop licence key is signed with Ed25519 and verified on your computer, so the app works offline. Activation happens once per device (up to 3); after that the app makes no calls to us. Your library and profile are kept in an encrypted vault on your computer, with a key derived from your licence.

• Passwords are hashed; sign-in attempts are rate limited.
• Workspace roles (owner, admin, creator, viewer) limit who can see, edit and share.
• Security and privacy actions (exports, deletions, role and link changes, DPA acceptance) go to an audit log that admins can review.
• Staff access to production is limited, personal and logged.

If you believe you have found a security issue, email security@[domain] with the steps to reproduce it. Please give us reasonable time to fix it before telling anyone else, and do not access other people's data or disrupt the service while testing. We reply within 3 working days and will credit you if you wish.