Security

In short

• Your video is deleted as soon as it has been processed. The results (screenshots and transcript) are deleted automatically 2 hours after you start the job. We keep no copies and no history.
• Only the browser or account that started a job can see its results.
• If you create an account, the only personal data we keep is your email address, and it is stored encrypted. We never store your password, only a fingerprint of it.
• No advertising, no analytics, no tracking, no third-party scripts.
• Transcription runs on our own servers: your video is not sent to any AI service.

What happens to your video, step by step

1. You paste a link or upload a file. We accept links only from the platforms we support (YouTube, TikTok, Instagram, Facebook, X and Vimeo). An uploaded file is checked to be a real video by looking at its contents, not just its name, and can be up to 500 MB. Its original file name is never stored.
2. It waits its turn. Your request joins a queue kept in memory. An uploaded file is held in a memory-only area, never written to a disk.
3. It is processed in a sealed room. The work is done by a separate, locked-down part of our system that cannot reach the internet on its own. It can only download from the supported platforms, through a gatekeeper that lets nothing else through. It works in a temporary folder that also lives only in memory.
4. You get the results. The screenshot sheets, the frames and the transcript are kept in memory and shown only to you: anyone else asking for them gets “not found”.
5. Everything is deleted. The video and the temporary folder are deleted as soon as processing ends, whether it succeeded or failed. The results are deleted automatically 2 hours after the job started. There is no backup of them: once they are gone, nobody can get them back, us included.

You don’t need an account to use ClipsForAI. When you start your first job we set a single technical cookie so that we know the results are yours (see the Cookie policy).

Your account

• Email: stored encrypted. To find your account at login we use a one-way code derived from the address, so the address itself never needs to be searched in clear.
• Password: never stored. We keep only a fingerprint made with a slow, salted algorithm (scrypt), which is designed to make guessing very expensive. Very common passwords are refused.
• Login protection: after 5 wrong passwords for the same address from the same connection, that connection is locked out for 15 minutes; many failures from everywhere lock the address for everyone for a while. The error message never reveals whether an address has an account.
• Password change or reset: every device is logged out and every API key is revoked.
• Your data, your choice: from your account page you can download your data or delete your account at any time.

What we never do

• Sell or rent your data, or show you ads.
• Use analytics, tracking pixels, fingerprinting, or scripts and fonts from other companies.
• Keep your videos, screenshots or transcripts beyond 2 hours, or use them to train AI.
• Write links, file names, video titles, email addresses or IP addresses into our logs.
• Use account cookies or logins on video platforms: private videos simply cannot be processed.

Downloading from video platforms

When you paste a link, our server downloads the video from the platform: the platform sees our server, not you. Some platforms, YouTube in particular, block downloads from data centres. For YouTube only, our server therefore connects through an external proxy provider (Webshare). The connection is encrypted end to end, so the provider sees only that our server is reaching YouTube’s addresses: not which video, not its content, and nothing about you.

Technical details

For the technically curious, and for anyone assessing ClipsForAI.

Transport and browser

• HTTPS only; plain HTTP is redirected. HSTS with a two-year max-age, includeSubDomains and preload.
• Strict Content Security Policy: only our own scripts, styles and images; no inline code, no third-party origins, no framing (frame-ancestors 'none').
• X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: same-origin, Cross-Origin-Opener and Resource Policy same-origin, a Permissions Policy that disables camera, microphone, geolocation and payment. No CORS.
• Session cookie __Host-vids: a random 256-bit identifier signed with HMAC-SHA256, HttpOnly, Secure, SameSite=Lax. Sessions live on the server and are destroyed at logout. State-changing requests must come from our own pages (Origin and Fetch Metadata checks).

Isolation of processing

• The web server never runs video tools. Processing happens in a separate container with no route to the internet, a read-only file system, all Linux capabilities dropped, a non-root user, and limits on CPU, memory, processes and time per job.
• The only way out is our own egress proxy: it allows only an explicit list of platform hosts, resolves names itself and refuses private and internal addresses, so a link cannot be used to reach our internal network.
• Links are checked against the list of supported sites; short links are expanded at most 3 times, each step checked again.
• Workspaces and uploads live in memory-only file systems (tmpfs, noexec) and are deleted in all cases when a job ends; a cleaner removes anything left over. Programs are started without a shell, so a crafted link cannot run commands. Frames are re-encoded without metadata.

Data at rest

• Email addresses are encrypted with AES-256-GCM; lookups use a separate HMAC-SHA256 key (blind index).
• Passwords: scrypt (N = 2¹⁵, r = 8, p = 1) with a random salt, compared in constant time; 10 to 128 characters, common passwords refused.
• API keys for the AI connector are shown once and stored only as SHA-256 hashes; they can be revoked at any time.
• IP addresses are never stored: for rate limits we keep only an HMAC of the address with a random key that changes every day and is discarded after 48 hours.
• Jobs, results and sessions are kept in memory (Redis) with persistence switched off. The account database sits on an encrypted disk volume.

Abuse protection and logs

• Rate limits per connection, per address and per account on sign-up, login, password emails, jobs and the AI connector; a daily cap on free processing protects the service for everyone.
• Logs accept only an explicit list of technical fields (route, status, timing, error codes). No personal data, no links, no request bodies.

Reporting a vulnerability

If you think you have found a security problem, please write to info@lumontec.it with a description and the steps to reproduce it. We will acknowledge your report and keep you informed while we fix it. Our security.txt file has the same contact details.

Please act in good faith: don’t access or change other people’s data, don’t degrade the service (no load or denial-of-service tests), and give us reasonable time to fix the problem before you make it public. We will not take action against research done in this spirit.

Honest limits

No system is perfectly secure, and we don’t claim otherwise. We don’t hold security certifications such as ISO 27001; what we offer is a design that keeps as little data as possible, for as short a time as possible. We review these measures as the service grows. If a breach ever affected personal data, we would notify the Italian Data Protection Authority and the people affected as the GDPR requires. For how we handle personal data, see the Privacy policy.