Security & Data Handling

What stays on your device

Your video file is opened and edited in your browser and is never uploaded to our servers. The final export is also created on your device.

What we process and store

• Audio chunks: short pieces of your audio (about 30 seconds each) are sent over HTTPS to Cloudflare Workers AI to create a transcript. We do not store the audio.
• Project data: the transcript, word timings, B-roll choices, caption and brand settings are stored in our database for 30 days, then deleted automatically.
• Search keywords: short keywords from your transcript are sent to Pexels to find matching footage. Never your video, audio or full transcript.
• Account data: name, email, a hashed password, your plan and minutes.

Encryption

• In transit: the whole site and API are served over HTTPS (TLS) through Cloudflare, and plain HTTP requests are redirected to HTTPS.
• At rest: account and project data live in a Cloudflare D1 database, which Cloudflare encrypts at rest.

Accounts and sessions

• Passwords are never stored in plain text. They are hashed with PBKDF2-SHA256 and a unique random salt.
• Sign-in sessions use a random token. Only a hash of the token is stored, and the browser cookie is HttpOnly so page scripts cannot read it.
• Sign-in attempts are rate limited to slow down password guessing.
• Requests that change data are checked against the site's origin.

Payments

Payments are handled by Stripe, a PCI DSS Level 1 certified payment provider. We never see or store your full card number. We do not connect to Stripe from our servers: we check each payment in our Stripe account and then activate the plan on your BrollBot account.

Retention and deletion

• Projects are deleted automatically 30 days after creation.
• You can delete a single project, or your whole account and its data, from the app at any time.
• Billing records are kept as required by accounting and tax law.

Sub-processors

These providers process data on our behalf or supply content to the service.

Your responsibilities

• Use a strong, unique password and keep it private.
• Keep your own copies of source videos and exports.
• Tell us straight away if you think your account has been compromised.

Reporting a vulnerability

If you believe you have found a security issue, email support@brollbot.com with a clear description and the steps to reproduce it. Please:

• give us a reasonable time to investigate and fix it before you disclose it publicly;
• avoid accessing, changing or deleting data that is not yours, and avoid actions that degrade the service;
• not use social engineering, physical attacks or denial-of-service testing.

We will acknowledge your report and keep you updated.

Certifications

We do not currently claim any security certification (such as SOC 2 or ISO 27001).

Related policies

See our Privacy Policy for how personal data is handled and our Cookie Policy for browser storage.