Vidmatic security

Where your data lives

• Vidmatic runs on a DigitalOcean server in the NYC1 region, in the United States.
• Recordings, uploads and the database are stored on a DigitalOcean volume attached to that server.
• Transcription (whisper.cpp) and AI voice-over (Kokoro) run on workers Vidmatic operates: on that server, with overflow to a Vidmatic-run worker that fetches the media over an authenticated connection. No third-party speech service is used.

Encryption

• In transit: every page and API call is served over HTTPS (TLS 1.2 or 1.3) with Let's Encrypt certificates. Plain HTTP redirects to HTTPS.
• At rest: Google refresh tokens and GitHub tokens are encrypted with Fernet before they are stored.
• API keys and MCP refresh tokens are stored only as SHA-256 hashes. A full API key is shown once and never stored.

Your code stays with your agent

• Your coding agent reads your repository on your own machine. The MCP server receives only what the agent puts in its tool calls (titles, narration scripts, issue text, stage reports), not a copy of your repo.
• Vidmatic's GitHub integration calls GitHub for repository details, issues, labels, assignees, comments, pull requests and CI check results. It never requests repository file contents.
• When an agent records a demo, its working files (rehearsal shots, the product brief) stay on your machine. Only the finished video, its title and its narration script are uploaded.

MCP access: OAuth 2.1, short-lived tokens

• The hosted MCP server is its own OAuth 2.1 authorization server. A client signs in from your browser with PKCE (S256) instead of a pasted key.
• Access tokens expire after 1 hour. Refresh tokens expire 30 days after their last use and rotate on every use; reusing an old one after a 60-second grace revokes the connection.
• At consent you grant full or read-only access. You can see and disconnect every connected app in Settings, Developer.

Who can see a recording

• A new screen recording is private until you share it.
• Demos your agents record get a public link by default. You can switch your account default to private in Settings; existing recordings are never changed by that switch.

Staff access

• Vidmatic's admin console has two staff roles: admin, and moderator. Moderators cannot manage users or read the audit log.
• A staff member's role is re-read from the database on every admin request, so removing access takes effect at once.
• Actions taken in the admin console are written to an audit log, kept for 30 days.

Backups and retention

• The database is backed up every night. The 7 newest backups are kept, and recording files are mirrored every night to a second disk.
• A recording you delete can be restored for 10 days, then it is purged for good.
• Account information and your recordings are kept while your account is active and you keep the content.

Subprocessors

DigitalOcean

Hosting: the server, its storage volume and backups.

OpenAI

Language features: titles, summaries, narration rewrites and issue drafts, from text derived from your content.

Stripe

Payments for paid plans.

ZeptoMail

Transactional email.

Google

Sign-in, and Google Analytics (not loaded when your browser sends Global Privacy Control).

GitHub

The Vidmatic GitHub App, when you connect it.

Discord

An internal alert to our team (name, email and plan) when a new customer starts paying.

The privacy policy describes what each kind of provider receives.

Compliance

• Vidmatic does not hold a third-party security certification today.
• Vidmatic is not certified for HIPAA, PCI-DSS or similar regulated workloads, so do not record that kind of data on screen.
• We do not sell personal information, and we do not let our AI providers train their general-purpose models on your content.