Security & trust

The whole list.
Including the empty rows.

Most security pages are written to survive a skim. This one is written to survive a check: every control below is either something running in production right now, something that exists but is switched off, or something we simply do not have.

Read this first. Vidmoat has no SOC 2 report, no ISO 27001 certification, and no third-party penetration test. It has no SSO, and it runs on a single server whose backups are currently local-only. If any of those is a hard requirement, stop here — we are not the right vendor for you yet, and we would rather you learn that on this page than in week three.

What is left is a small, specific set of things we do carefully. Those are the rest of this page.

Assurance

Certifications and audits

SOC 2 Type I or IINot yet
No audit has been performed. There is no report, and no engagement underway that we could describe as "in progress".
ISO 27001Not yet
Not certified, and not in an active certification process.
Third-party penetration testNot yet
None commissioned to date. No report exists to share under NDA.
Security questionnaireOn request
We will fill one in, and the answers will match this page. Where a control does not exist, the questionnaire will say so too.
Vulnerability reportsLive
Send them to the contact form on this site and they reach a human the same day. No bounty programme yet.
Identity

Who someone is, and what they may do

User authenticationLive
Email and password, or Google sign-in. One account per person, used across the editor, the dashboard, the developer portal and the effects marketplace — not a separate identity per surface.
SSO — SAML or OIDC against your IdPNot yet
Not implemented. There is no way to federate sign-in to Okta, Entra ID or Google Workspace as an identity provider today.
SCIM / automated deprovisioningNot yet
Removing someone is a manual action by a team owner or admin. Nothing syncs from your directory.
Enforced MFANot yet
We cannot require it. If your users sign in with Google, whatever MFA policy you enforce there applies — but Vidmoat neither sets nor verifies that policy.
Role-based authorisation inside a teamLive
Four ordered roles — owner, admin, member, viewer. Every permission is re-checked server-side on every request; the role gates in the interface decide what a member is shownand are explicitly not a security boundary. A non-member asking about an org gets a 404 rather than a 403, so org ids cannot be enumerated by watching which ones come back “forbidden”.
Invite handlingLive
Invites expire after seven days and are bound to the invited address — accepting requires the signed-in account to hold that email, so a forwarded or leaked link is inert. An invite can grant admin at most; ownership is a transfer, never something a URL can mint. Re-inviting supersedes the previous token rather than leaving two live.
Credentials

API keys, OAuth and abuse limits

Scoped API keysLive
A key carries an explicit set of coarse permissions — projects.write, render.write, media.read, ai.agent and twelve more. Before scopes existed a key was full impersonation of its owner; keys minted then are still distinguishable in the database precisely so that grant can be retired deliberately rather than silently backfilled away.
Scopes cannot be used to escalateLive
Passing the scope check never skips the plan-entitlement check or the credit check. A key holding ai.video whose owner is not on a plan that includes generative media still gets a 402 — otherwise minting a scope would be a way to buy a feature for free.
OAuth apps with a consent screenLive
For products acting on your users’ behalf rather than your own. The consent screen and the key-minting form are generated from one description of each permission, so the two can never describe the same grant differently.
Rate limitingLive
A sliding-window limiter sits in front of every metered service — agent runs, renders, uploads, transcription, generation, the public endpoints. A rejected request does not consume quota, so a client that retries can always get back under its own limit instead of locking itself out.
Third-party plugin isolationLive
Marketplace plugins are invoked through the platform rather than handed your credentials, and each declares what it needs before it can be connected.
Customer-visible audit logNot yet
Vidmoat keeps an internal event log and an admin activity log, but there is no export or interface that shows an organisation its own audit trail. If you need one, say so on the contact form — it is a concrete, bounded piece of work rather than a research project.
Data

Your files, and getting rid of them

Asset accountingLive
Every uploaded file has a ledger row: who uploaded it, when, its size and a SHA-256 of its contents. Re-uploading the same footage reuses the existing file instead of writing a second copy.
Account deletion removes the bytesLive
Deleting an account deletes its rows and its files from disk, not just the references to them. A retention sweep separately reaps unreferenced uploads after a grace window, and it will not touch a file that is still referenced by a project, a published post or an avatar.
Team-scoped mediaLive
An asset can be moved into a team’s shared library, which changes who can see and use it. It deliberately does not change who pays for it: quota stays with the uploader.
Customer-managed encryption keysNot yet
Storage is encrypted at rest by the host filesystem and disk. You cannot supply or rotate your own key.
Regional data residencyNot yet
There is one region. You cannot pin your organisation’s data to a jurisdiction.
DPA, retention terms, deletion SLAs in writingOn request
Not self-serve, and not boilerplate we can point at. Ask and we will work through what we can honestly commit to.
Infrastructure

How it runs

Transport and browser hardeningLive
HSTS with a two-year max-age, subdomains included and preload requested; X-Content-Type-Options: nosniff; a strict referrer policy; cross-origin opener isolation; and framing denied everywhere except the one surface that is an embedded mini-app by design.
Content Security PolicyReport-only
A CSP ships, but in report-only mode. An enforcing policy needs per-request nonces for the framework’s inline bootstrap, and shipping a guessed policy in enforcement mode takes the whole site down at once. We would rather tell you it is report-only than let you read "CSP" on a checklist and assume otherwise.
Deploy safetyLive
Releases build into an inactive slot and the serving directory is never written to mid-build, so a deploy cannot pull chunks out from under live requests. The process carries top-level handlers for unhandled rejections and uncaught exceptions, which is what stopped an earlier class of outage where one stray rejection killed the server.
High availability / failoverNot yet
Vidmoat runs as a single application server. There is no second region, no automatic failover, and no contractual uptime commitment. If a hard availability number is a requirement for you, this is the row that matters.
Offsite backupsNot yet
The database is backed up nightly to the same machine. Offsite replication is not yet in place. Stated plainly because a backup that shares a failure domain with the thing it backs up is not really a backup.
Status page / incident notificationsNot yet
There is a health endpoint the platform monitors itself with, but no public status page and no formal incident-communication process.
Provenance

Proving an export came from you

Every render is tagged in its container metadata with VM1-<job>-<timestamp>-<signature>, signed with HMAC-SHA256. Anyone can verify a tag, or the file itself, at vidmoat.com/verify without an account. The tag carries no user information; the trace from a job back to a project and an account is server-side and staff-only.

Two limits, stated once and not buried. The signature covers the render job and its timestamp, not a hash of the content — so it proves origin, not that the frames are unaltered. And container metadata does not survive a platform re-encode: a file that has been through TikTok or YouTube ingestion comes out untagged. Verify the master you hold.

The pixel-domain watermark that would survive a re-encode is written but disabled by default — see the note on the overview. Do not plan around it.

Something missing that you need?

Several of the “not yet” rows are small pieces of work rather than impossibilities — a customer-visible audit log, in particular. Tell us which row is blocking you and we will tell you honestly whether it is weeks or quarters.