Trust & Security

Does AetherCut upload my video to its servers?

No. Editing, rendering, and export run in your browser using HTML5 Canvas, WebCodecs, and FFmpeg.wasm, so source video is not uploaded to AetherCut servers. You can confirm this by checking your browser network activity during editing and export.

The single most important security property of AetherCut is architectural: editing, rendering, and export all run in your browser using HTML5 Canvas, WebCodecs, and FFmpeg.wasm. Your source video is never uploaded to our servers — so it cannot be breached, subpoenaed, or leaked from a place it never was.

You can verify this yourself: open your browser's DevTools → Network tab while you edit and export. You will see zero outbound video bytes. See /network-traffic-analysis for a request-by-request breakdown.

Encryption

• In transit: all traffic is HTTPS/WSS only (TLS 1.2+). We do not serve any content over plain HTTP.
• At rest: the small amount of data we do store (account record, saved-project metadata, payment status) sits in an encrypted-at-rest database.
• Secrets (API keys, tokens) are held in server environment configuration, never in client code and never committed to source control.

Data minimization

We collect the minimum needed to run the product. No advertising IDs, no device fingerprinting, no cross-site tracking cookies, no full IP storage.

The complete, honest inventory lives on two pages: /what-data-we-collect and /what-data-we-do-not-collect. If something exists in our database that isn't on the first list, treat it as a bug and report it.

Authentication & access control

• Sign-in is optional and uses Google OAuth — we never see or store a password.
• Administrative access is restricted, key-gated, and follows least-privilege.
• Production credentials are rotated when exposed and are scoped to the narrowest role that works.

Does AetherCut store my card number?

No. Stripe collects card details directly, so AetherCut does not see or store your card number. It keeps only non sensitive payment references needed to grant and revoke Pro access.

Payments are processed by Stripe. AetherCut never sees or stores your card number — Stripe collects it directly. We retain only non-sensitive references (customer ID, payment-intent ID, amount, status) so we can grant and revoke Pro access. Card handling (PCI DSS scope) is delegated to Stripe.

Subprocessors

A subprocessor is a third party that may process data on our behalf. Because your video stays on your device, most of ours only ever receive small derived inputs (e.g. a few seconds of extracted audio, a text prompt, or timeline metadata) — and only when you explicitly trigger that feature.

The full, current list is published at /subprocessors.

Does AetherCut work offline if the network goes down?

Yes, core editing works offline once the Progressive Web App is loaded. If the network or servers are unavailable, the local editor still works, while AI features continue to require network access.

• The editor is a Progressive Web App — core editing works offline once loaded, so a network or server outage doesn't strand your project.
• Server-side data (accounts, saved projects) is backed up, and restores are tested.
• AI features require network access and depend on third-party providers; if one is unavailable, the local editor keeps working.

Compliance posture (stated honestly)

We would rather under-claim than mislead you, so here is exactly where we stand:

• SOC 2 / ISO 27001: not yet certified. These are on our roadmap, and our architecture already implements many of the underlying controls (encryption, least-privilege access, minimal data footprint, change review). A readiness program can be started on request for enterprise evaluations.
• GDPR / CCPA: we honor data-access and deletion requests (/delete-account), minimize collection, and maintain the subprocessor list on this site.
• HIPAA: AetherCut is 'HIPAA-conscious' by design (footage stays on-device), but we are not a certified HIPAA vendor and do not currently sign BAAs. If you handle PHI, contact us before relying on any cloud AI feature.
• PCI DSS: card data is fully delegated to Stripe.

Vulnerability reporting (responsible disclosure)

Found a security issue? We want to hear about it. Email AethercutAdmin@gmail.com with details and steps to reproduce. Please give us reasonable time to fix before public disclosure; we will not pursue good-faith researchers who follow this policy.

Incident response

If a security incident affecting user data occurs, we will investigate promptly, remediate the root cause, and notify affected users and regulators as required by applicable law. Because we hold so little user data and no video content, the blast radius of any incident is deliberately small.

For legal & regulated teams

If you work in a regulated field — legal, healthcare, finance or government — the no-upload architecture above is the whole point: there is no server-side copy of your footage to secure, subpoena, or breach. We wrote up the regulated workflow (chain of custody, redaction, retention) on a dedicated page:

• AetherCut for legal & regulated teams
• Video editor for lawyers — depositions, evidence, exhibits