Security at Klippfy
Last updated: July 20, 2026
This page summarizes the security measures we apply to protect your account and your content, how to report a vulnerability to us, and what we do if a security incident occurs.
1. Encryption and transport
HTTPS across the whole Service
All connections between your browser or API client and Klippfy travel encrypted via HTTPS/TLS. We do not serve sensitive content over unencrypted HTTP.
2. Authentication and credentials
Hashed API keys
API keys are stored hashed in our database, never in plain text. Not even the Klippfy team can recover your original key after it has been issued — you can only generate a new one if you lose it.
3. Infrastructure and providers
- File storage: original videos and clips are stored in Cloudflare R2 for the duration of your job, and are automatically deleted after 7 days (see Privacy Policy, section 4).
- Processing/rendering: runs on Modal infrastructure.
- Payments: processed entirely by Paddle; Klippfy never stores card numbers.
[TO COMPLETE if applicable: details on backups, redundancy, provider-specific encryption at rest, certifications (SOC 2, ISO 27001, etc.) if you have them. If you don't yet have these practices formalized, it is better to leave this section out entirely rather than leave the placeholder visible in production.]
4. Rate limiting and abuse prevention
We apply rate limits per IP and per API key across all endpoints to mitigate abuse, automated scraping, and brute-force attacks.
5. Internal access
[TO COMPLETE: policy restricting team access to production data, use of internal 2FA, principle of least privilege, if applicable. Same criterion as the point above: better to omit the section than to leave it with a placeholder.]
6. What we do in the event of a security incident
If we detect a security breach affecting users' personal data, we will:
- investigate and contain the incident as soon as possible;
- notify the competent data-protection authority when the applicable regulation requires it and within the corresponding deadline (for example, 72 hours from when we become aware, under the GDPR, if the incident involves EU/EEA users);
- notify you without undue delay if the incident poses a high risk to your rights or freedoms, indicating what data was affected and what measures we took.
7. Reporting a vulnerability
If you find a security vulnerability in Klippfy, we ask that you report it to us responsibly before disclosing it publicly:
- Write to us at [email protected] with the technical detail and steps to reproduce it.
- Do not access, modify, or delete other users' data while investigating the issue, and do not publicly disclose the finding until we have fixed it or 90 days have passed since your report.
- We will confirm receipt and keep you informed of the fix's progress.
Safe harbor commitment: as long as your research complies in good faith with the above conditions, Klippfy will not initiate or refer legal action against you for finding or reporting the vulnerability, and will consider your research authorized under this policy. This commitment does not apply if the report is accompanied by a demand for payment, a threat of early public disclosure, or any other form of extortion.
At this time, Klippfy does not offer a paid bug-bounty program for vulnerability reports, although we equally value and appreciate every responsible report.
8. Contact
Klippfy — [TO COMPLETE: full legal/company name and registered address in Mexico] — [email protected]