Keep content inside a clear trust boundary.
Understand who can access your files, how long they remain available and what happens when you delete them.
Access follows your project permissions.
Knowing a project address does not grant access. You must be signed in with permission to open that project.
Your sign-in and project permissions are checked before you can view or change content.
Know what happens to your files.
Private file transfers
Upload and download links are limited to the relevant file and expire after a short time. Private file links stay out of logs and browser storage. Request a new link if yours expires.
Content retention
Source retention depends on your plan. Source files and subtitle results can have different deadlines. Check each file and result for its recorded availability deadline.
Content deletion
Deleting content revokes access first. Stored files are then removed in the background. A deletion request does not mean stored files have already been removed. Check its status for confirmation.
Keep sensitive content private.
Do not log content
Media, subtitles, signed URLs, object keys, tokens, and provider responses stay out of logs and analytics.
Keep service secrets out of the browser
Service API keys and configured identity credentials remain inside the controlled server boundary.
No formal security or compliance certification is claimed.
Planning an integration?
Review API access, account permissions and SDK availability.