Security

Last updated: October 8, 2026

Protecting our users' recordings and transcripts is fundamental to what we build. This page summarizes our security practices and how to report a vulnerability.

Our practices

• Encryption in transit. All traffic to our websites and APIs is served over HTTPS/TLS.
• Secure storage. Media files are stored in access-controlled object storage and accessed through short-lived, presigned URLs.
• Access control. Production access is limited to authorized personnel on a least-privilege basis. API access uses revocable per-user API keys with rate limiting.
• Payments. Payments are processed by Stripe; we never store full card numbers.
• Data ownership. Your content belongs to you. We don't sell personal data.

Responsible disclosure

If you believe you've found a security vulnerability in any NanoUltra product, please email hello@nanoultra.co with the subject "Security report". Please include steps to reproduce and the potential impact.

• Give us reasonable time to investigate and fix the issue before public disclosure.
• Do not access, modify or delete other users' data, and avoid degrading our services.
• Do not use social engineering, physical attacks or denial-of-service testing.

We will acknowledge your report, keep you informed of progress and credit you if you wish. Our machine-readable contact is published at /.well-known/security.txt.