Authentication
Sign in with an email link, Google or a passkey (in the mainland China edition: password, SMS code or passkey). Passwords are stored only as salted hashes, and sessions live in HTTP-only cookies.
Security
How we protect your work
A production workspace holds unreleased scripts, characters, and footage. Here is what we do to protect it — stated plainly, without certifications we don’t have.
Roles and per-project access
Every workspace has owner, admin, member, commenter, viewer, and guest roles. Guests see only the projects they are invited to, and every request is checked against the caller’s access on the server.
Encryption
All traffic to ClipTap is encrypted in transit with TLS. Uploaded and generated files are kept in object storage that encrypts data at rest.
Provenance and audit
Each generation records who ran it, with which model and settings, and a project’s activity log shows who changed what and when. Billing changes are audited too.
Payments
Payments are handled by Stripe, a PCI DSS Level 1 certified service provider. Card numbers go to Stripe directly and never touch our servers.
Your content
We don’t train AI models on your content. Prompts and references are sent only to the model provider that runs the generation you choose. A deleted project or account is kept for 30 days, when only our support team can recover it, and then permanently deleted.
Responsible disclosure
If you believe you have found a security vulnerability in ClipTap, email [email protected] with the steps to reproduce it. We will acknowledge your report within 2 business days, keep you updated while we fix it, and credit you if you wish.
Please give us reasonable time to fix an issue before disclosing it, and don’t access other people’s data, degrade the service, or run automated scans that generate heavy traffic while testing. We will not pursue legal action against good-faith research that follows these guidelines.
For how we handle personal data, see our Privacy Policy.