Security

How we hold your footage

Plainly, and in full. A security page that lists only strengths is marketing.

The strongest control is architectural

Your source video is deleted when you collect your clips — at the latest after seven days. Clips last thirty. A breach can only expose data that still exists, and that single design decision removes more risk than any firewall we could buy.

No passwords, anywhere

We never create, store or ask for a password — so there is no password database to leak, no reuse risk, and no reset flow to get wrong.

You enter your email

We generate 32 bytes of cryptographic randomness and store only its SHA-256 hash. The raw token exists in exactly one place: the email we just sent you.

You click the link

Valid for fifteen minutes and usable once. Expired, reused or unknown tokens all return the same generic response, so the page cannot be used to discover which email addresses have accounts.

A session is created

An opaque identifier in an httpOnly · Secure · SameSite cookie — never a token in browser storage where a script could read it. The session lives server-side, which means we can revoke every session everywhere, instantly.

First sign-in creates the account

There is no separate signup form. The same link that signs you in creates your account and grants the free hour — one less flow to secure.

The honest trade-off

Passwordless means your account security equals your email security. That is better than most passwords in practice, but it is one factor. If you need a second, ask us — we will prioritise it for Studio customers.

Credits

Charged on completion, never on submission

Billing is measured in minutes of source material, shown to you as hours.

Rule	Value	Why
Billing unit	1 minute of source	Hour-rounding punishes short uploads
Minimum per job	10 minutes	Stops tiny uploads flooding the queue at no cost
Maximum per job	12 hours	Matches storage and queue limits
Charged	on success only	A failed job costs you nothing
Shorts produced	does not affect price	Compute follows source length, so price should too
Top-up credits	never expire	Spent after your monthly allowance, so you never lose what you paid extra for

How a job reserves credit

On submit we place a hold for the estimated length and refuse the job if your available balance is short. On completion the hold converts to a charge using the actual measured duration and the difference is released. If the job fails, the whole hold is released. Without this, ten long jobs could be queued against one hour of balance.

Controls

What protects what

Layer	Control
Upload	Your file goes straight from your browser to storage with a signed, expiring URL. It never passes through our application server.
Download	Signed URLs with short expiry. No bucket is ever public.
Payments	Handled entirely by Stripe on their pages. Card details never touch our systems.
Transport	TLS everywhere, HSTS.
Database	Row-level security — a query cannot reach another account's rows even if application logic is wrong.
Auth gate	Fails closed. A broken verifier denies access; it never defaults to allowing it.
Secrets	Environment only, never committed, rotated on staff change.
Voice profiles	We hold none. Customer voice enrolment is not built, so there is no biometric data in your account to protect or to delete. When it is built it will store a numeric vector, never audio — and this row will say so only once that is true.

Protections

How your account is defended

The controls that are live today, in plain language.

Live on every account

Two-factor authentication (TOTP, RFC 6238), opt-in from the dashboard. With it on, the email link alone can no longer open your account.
Signed, expiring delivery links — your clips are never served without a valid, time-limited signature.
Request defence in depth: rate limiting on sign-in, a five-attempt cap on two-factor codes, a hard request-size limit, path-traversal guards on every file, and security headers on every response.
Cloudflare fronts the whole service — TLS, DDoS protection and an edge firewall before a request ever reaches us.
Independently reviewed. An adversarial review was run against the live service; every issue it found was fixed and pinned with a test that runs before each deploy.

On the roadmap

Formal certifications (SOC 2, ISO 27001) and an external penetration test — planned as we grow. Ask us where they stand any time: security@vigge.pro.

Incident response

If we are breached

Written down in advance, because the middle of an incident is the worst time to decide what to do.

Hour 0–1 · contain

Revoke every session everywhere
Rotate all keys and secrets
Pause uploads and the queue
Ship logs off-box before anything is touched
Invalidate all signed links

Hour 1–24 · assess

Establish exactly which data classes were reachable
Most source video will already be deleted by retention
Preserve evidence for the authority

Within 72 hours · notify

Swedish authority (IMY), as GDPR requires
Affected users without undue delay
Plain language: what happened, what data, what we did, what you should do

After · publish

Rebuild from clean images, not by cleaning the compromised host
Public post-mortem with a timeline
Reputation survives handled breaches — not hidden ones

Report a vulnerability: security@vigge.pro — we will not pursue anyone acting in good faith

Questions

Ask us anything about this

If something here is unclear or you need it in a signed document, write to us.

Data processing terms Privacy notice

Status

ViggeClips is live and reachable, on the free tier only. Paid processing of anyone else's footage is deliberately not switched on yet. The data protection impact assessment for voice profiles was completed 2026-08-09; an independent Swedish legal review of it remains outstanding and must be complete before paid processing of anyone else's footage.
Vulnerability disclosure follows RFC 9116 — see /.well-known/security.txt.