Security and Data Handling

Account security

• Cookie-backed authentication uses CSRF protections for unsafe requests.
• Email verification is enforced for gated actions such as billing, translation, and export workflows.
• Two-factor authentication is supported for account sign-in.
• Password reset and email verification flows include throttling and token lifecycle controls.

Media and project handling

• Uploads are designed around signed object-storage URLs so large media does not need to move through the web server for every transfer.
• Private project assets can include source media, generated captions, translations, waveform data, thumbnails, subtitle files, and rendered video exports.
• Processing workers handle ingest, transcription, translation, and export jobs and report status back to the backend.
• CutCaption does not use, or permit providers to use, video, audio, subtitles, transcripts, captions, translations, or derived project data to train public, provider-owned, or CutCaption internal general-purpose AI models.

Infrastructure and providers

The repository shows S3-compatible object storage, Cloudflare R2 in prod-like environments, Stripe for billing, Resend for email, Cloudflare Turnstile for signup CAPTCHA, optional Sentry error monitoring, and DeepSeek for requested subtitle translation.

Production hosting, backup, retention, and incident-response practices may evolve as CutCaption scales. This page should reflect the current public commitments without overstating certifications or guarantees.

Current limitations

CutCaption does not currently claim SOC 2, ISO 27001, HIPAA, PCI certification, dedicated enterprise security terms, or a guaranteed uptime SLA.

Do not upload regulated health, financial, government, or highly sensitive content unless you have confirmed that the current service terms and security posture are appropriate for your use case.

Reporting security issues

Report suspected vulnerabilities or account security issues to [email protected]. Include the affected account, a clear description, reproduction steps if safe to share, and any relevant timestamps.