Security

This page describes the security controls Reeltopus has in place today, what we haven't done yet, and how to report a vulnerability. Reeltopus is run by Turncraft Private Limited. For how we use personal data, see the Privacy Policy; for the providers that handle it, see Subprocessors.

Encryption

• In transit: every connection to reeltopus.com uses HTTPS, and browsers are told to use nothing else for two years (HSTS).
• At rest: our database (Neon) and video storage (Cloudflare R2) are encrypted at rest by those providers. On top of that, we encrypt the sign-in tokens for your connected social accounts and your webhook signing secrets with AES-256-GCM, each bound to its own record, so a token copied to another record won't decrypt.

Secrets we never store

• Sign-in links: we keep only a hash, and a link works once, for 15 minutes.
• API keys: we keep only a SHA-256 hash and the first few characters, so you can tell keys apart.
• OAuth access and refresh tokens issued to connected apps: hashed, rotated on every refresh, and revoked if a refresh token is reused.
• Card numbers: Paddle, our merchant of record, takes payments. We never see or store card details.

Access to your data

• Every page, API route and MCP tool reaches records only through checks scoped to your workspace, including ids sent in request bodies. Automated tests check that one workspace can't read another's data.
• Only workspace owners and admins can create API keys or change the plan.
• Apps you connect over OAuth 2.1 (for example an AI assistant) use PKCE, exact redirect matching and the scopes you approve on our consent screen. You can disconnect any of them under Settings → API.
• Access to production systems is limited to the people who run the service.

Protections in the app

• Cookie-authenticated changes are refused unless they come from reeltopus.com itself (cross-site request protection).
• Requests we make to addresses you give us (webhooks, OAuth app metadata) can't reach private or internal networks, including through DNS tricks, and don't follow redirects.
• Uploads must be a video or audio type we accept, and files are served back so a browser can't run them as a page.
• Rate limits shared across all our servers: sign-in emails, the waitlist, chat edits, imports, uploads, and the public API (per key, by plan).
• Webhooks we send are signed (Standard Webhooks). Payment and render notifications we receive are checked with constant-time signature comparison and a 5-minute window.
• Every response carries security headers: HSTS, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, a referrer policy, a permissions policy, and a content security policy that blocks framing, plugins and base-tag tricks.

Your content and AI

We don't use your videos, transcripts or clips to train AI models. Our AI providers process your content only to give you the result; under its commercial terms, Anthropic doesn't train its models on what we send it. A cloned voice is made only after you confirm you have the speaker's consent, and is deleted after the dub.

Your data, your control

• Download everything we hold about you from Account → Download my data.
• Delete your account from Account → Delete my account. It's erased 7 days later, unless you sign in and keep it; we revoke our access to your connected accounts and delete your videos and exports.

Incident response

If we find or are told about a security incident, we:

• contain it first: revoke keys or tokens, block the route, or take the affected part offline;
• work out what happened, which data and which customers were affected, and fix the cause;
• tell affected customers without undue delay, and the authorities the law requires: the Data Protection Board of India, and the relevant supervisory authority within 72 hours where the GDPR applies;
• write up what happened and what we changed, and share it with affected customers.

Not done yet

So you can judge for yourself, here is what we haven't done:

• No SOC 2 or ISO 27001 report, and no third-party penetration test yet.
• Our full content security policy runs in report-only mode while we check it doesn't break checkout.
• Error tracking, alerting and a public status page are being set up.
• No single sign-on (SAML) or audit log yet.

Report a vulnerability

Email security@reeltopus.com with what you found, the steps to reproduce it, and what an attacker could do with it. We reply within 3 business days, keep you updated while we fix it, and credit you if you'd like. We don't run a paid bug bounty yet.

If you act in good faith, we won't take legal action against you for your research. That means: test only against your own account or one you have permission to use; don't access, change or keep other people's data (stop and tell us if you reach any); don't degrade the service (no denial-of-service, spam or social engineering of our staff or providers); and give us 90 days to fix the issue before you share details publicly.

Our security.txt has the same contact in the standard format.