Security

Security at ShortLoom

Last updated August 8, 2026

This page describes the concrete measures we take to protect your account and content. We do not hold a formal certification (SOC 2, ISO 27001) yet - rather than claim one, we list here what is actually in place, and we rely on certified infrastructure providers for the layers underneath.

Infrastructure & data protection

Encryption in transit. All traffic is served over HTTPS with HSTS (including subdomains, preload enabled).
Encryption at rest. The database and file storage are hosted on Supabase (AWS), which encrypts data at rest. Media is served from provider CDNs over TLS.
Row-level security. Database access is enforced by Postgres row-level security policies, so one account can only ever read its own rows; server-side writes go through a scoped service role.
Per-user API keys. Public API and MCP access use per-user keys (prefix fl_) scoped to your account, revocable individually.
Secrets management. Provider credentials and OAuth tokens are stored as environment secrets, never in the codebase or client bundles; connected-account tokens are stored server-side only.

Application security

Content Security Policy. A strict CSP, frame-ancestors, and other hardened headers limit what scripts and frames can run on the site.
Abuse controls. Rate limiting and credit-reservation guards protect generation endpoints against abuse and race conditions.
Failed-render refunds. A generation that fails on our side is automatically refunded, so an outage never silently consumes your balance.
Consent-gated sensitive features. Voice cloning and face/avatar uploads require explicit consent and can be withdrawn at any time.

Sub-processors

We rely on a small set of infrastructure providers, each covered by its own security program and DPA. The full, current list of sub-processors (what each receives and its scope) is maintained on the sub-processors page.

Data retention & deletion

Data is kept on fixed schedules enforced by an automated daily job (for example, intermediate tool outputs are deleted after 30 days, source voiceovers 7 days after render). You can delete your account and all associated data at any time from Settings → Account. The full retention schedule is in the Privacy Policy.

Reporting a vulnerability

If you believe you have found a security issue, please email support@shortloom.ai with the details. We ask that you give us a reasonable window to investigate and fix before any public disclosure. We do not currently run a paid bug-bounty program.