Security Policy

At Hookable, protecting your data and maintaining the security of the Service is a core priority. This Security Policy describes the technical and organizational measures we employ to safeguard your information.

Transport Security

All data transmitted between your browser and our servers is encrypted using HTTPS with TLS 1.3. This applies to:

• All API requests and responses
• Video and file uploads and downloads
• Authentication flows
• Webhook and third-party service communications

We enforce HTTPS-only connections and reject insecure HTTP requests.

Authentication and Access Control

User authentication is handled by Clerk, using industry-standard RS256 JSON Web Tokens (JWT). Key security properties include:

• JWTs are cryptographically signed with RSA-256 and verified against Clerk's public JWKS on every API request
• Tokens have short expiry windows to minimize the impact of token compromise
• Clerk supports multi-factor authentication (MFA) for enhanced account security
• All API endpoints require authentication — no anonymous access to user data

Project-Level Authorization

Every request to access project data is validated to ensure the authenticated user owns that project. Users can only access their own projects, videos, and associated data — there is no cross-user data access.

File Storage Security

All files (uploaded videos, B-roll clips, audio, and exported videos) are stored in Cloudflare R2, which provides:

• Encryption at rest for all stored objects
• Encryption in transit for all file transfers
• Presigned URLs for file access — all downloads and uploads use time-limited cryptographically signed URLs that expire after a short period
• No public bucket access — files are never accessible without a valid presigned URL

Presigned URLs are generated server-side after verifying ownership, ensuring no unauthorized file access is possible even if a URL is shared.

Database Security

Application data is stored in Supabase PostgreSQL, hosted in the EU region. Security measures include:

• Database is accessible only through the backend API — no direct client connections
• All database access is performed using authenticated, server-side service credentials
• Supabase provides encryption at rest and in transit
• Row-level security capabilities are available and enforced at the application layer

AI Processing Security

AI transcription (WhisperX) and video rendering (Remotion) run on Modal's cloud infrastructure. Key security properties:

• Each processing job runs in an isolated, ephemeral container
• Containers are terminated after each job completes — no data persists in compute containers
• Processing access is restricted to specific R2 paths via presigned URLs generated for each job
• No persistent storage within the AI compute environment

Payment Security

All payment processing is handled by Stripe, which is PCI DSS Level 1 certified — the highest level of payment security certification. We never store, log, or process raw payment card data on our servers. Stripe handles all cardholder data within their secure, certified environment.

Operational Security

• Dependencies are regularly reviewed and updated to address known security vulnerabilities
• Security patches are applied promptly upon availability
• API rate limiting is applied to prevent abuse
• CORS policies restrict cross-origin access to the API

Limitations

While we implement strong security measures and continuously work to improve our defenses, no system is 100% secure. We cannot guarantee absolute security of your data against all possible threats. In the event of a security incident affecting your data, we will notify you in accordance with applicable legal requirements (including GDPR notification obligations).

Responsible Disclosure

We take security vulnerabilities seriously. If you believe you have found a security vulnerability in Hookable, we encourage responsible disclosure. Please report vulnerabilities to:

Please include a description of the vulnerability, steps to reproduce it, and its potential impact. We will acknowledge receipt within 72 hours and work to address valid issues promptly. We ask that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and remediate it.

Contact

For general security questions or concerns, contact us at [email protected].