Security & Data Handling

1.Overview

You trust us with recordings that can contain faces, voices and business conversations. This page describes how we handle that data, what we promise, and what we do not claim. The video-handling practices below apply from the day video processing is available; until then no videos are processed or stored. If something here is unclear, ask us at support@cleanoise.com.

2.What happens to your video

1. Upload. Files travel over an encrypted connection to temporary storage.
2. Processing. Automated tools apply only the fixes you select and create a processed file. Processing happens in isolated jobs.
3. Preview and download. You compare and download from your workspace. Only you and members of your plan can access the files.
4. Deletion. Uploaded and processed files are deleted automatically after 30 days, or immediately when you delete a project.

3.Encryption

Data in transit between your browser and our services is protected with modern TLS (HTTPS). Stored files and backups are encrypted at rest using the encryption provided by our storage infrastructure.

4.Access controls

• Role-based access: plan members see only the projects they are entitled to.
• Internal access to production systems is limited to staff who need it, protected by strong authentication, and logged.
• We do not look at your videos unless you ask us to help with a specific issue or the law or a security investigation requires it.

5.Infrastructure

The website and service run on established cloud providers that apply standard physical, network and platform security controls. Production, staging and development environments are kept separate, and secrets are stored outside source code.

6.Monitoring and logging

We monitor the service for errors, abuse and suspicious activity and keep audit logs of administrative actions to support detection, investigation and response.

7.Payments

Payments are handled by Stripe, a payment processor that is certified to PCI DSS Level 1. Card numbers go directly to Stripe; they never touch or get stored on our servers.

8.Training and your content

You can opt out of any use of your content for model training. The switch is on by default (opted out) at signup and can be changed in settings. See the Privacy Policy.

9.Retention and deletion

Files are deleted after 30 days or when you delete them, whichever is first. Backups holding deleted data are overwritten on a rolling schedule. You can request deletion of your account and associated data at any time by emailing privacy@cleanoise.com.

10.Sub-processors

We use the providers below to deliver the service. Each is bound by a data protection agreement, and where data leaves your region we rely on the safeguards shown. The compute and storage providers that will process your videos will be added to this list before any file is processed, and we will update it before adding any new sub-processor that handles your content.

11.Incident response

We maintain an incident response process covering detection, containment, investigation, fixes and review. If a personal data breach affects you, we will notify you without undue delay and, where required, the relevant authority within 72 hours of becoming aware, with what happened, what data was involved and what you can do.

12.Reporting a vulnerability

If you believe you have found a security issue, email support@cleanoise.com with steps to reproduce. Please:

• give us reasonable time to investigate and fix before any public disclosure;
• avoid accessing, changing or deleting other people's data, and do not degrade the service;
• test only against your own account.

If you act in good faith under these rules, we will not take legal action against you and will credit you if you wish.

13.Compliance and certifications

We design our data handling to meet GDPR, UK GDPR and CCPA requirements. We do not currently hold SOC 2 or ISO 27001 certification and will say so here when that changes.

14.Your responsibilities

• Use a strong, unique password and keep it private.
• Give seats only to people who need them and remove them when they leave.
• Download your outputs before the retention period ends.
• Only upload content you have the right to use, and tell us promptly if you suspect unauthorised access.

See the Privacy Policy for how we handle personal information.