Trust
Security at ClipYourSaaS
We drive a real browser inside your app, so we treat access to it carefully.
Your app, your accounts
Connect any public site, or any site you can sign in to. You must have the right to use the account you connect and to record it. Every address we open, including your reset link, must be on the public internet: private and internal addresses are refused when you save them and again at every connection.
Your password stays yours
You sign in to your app yourself, in a secure browser that runs on our workers and is streamed to your screen. We keep only an encrypted signed-in session; we never see or store your password. Sessions are sealed with AES-256-GCM using versioned encryption keys that we can rotate, are opened only inside an isolated job, and are never shown to the AI. Disconnect an app to delete its session at once, or have us forget it after every video.
You choose what changes
Demos are view-only by default. You can allow only the changes you describe, or any changes in an account kept for demos. Add a signed reset link and we restore the account before every run; without one, changes stay and repeat several times per video. In every mode the demo never signs out, changes the sign-in, deletes the account or leaves your app. Every step is checked before it is used in a video.
Isolated workers
Recording jobs run in isolated worker containers with read-only filesystems. Outbound requests pass an egress guard that blocks private, internal and cloud-metadata addresses, so a job cannot reach our internal network.
Retention
Recordings, scripts and narration are kept with each video so you can revise it. Deleting a video's workspace permanently removes its files, and deleted workspaces are purged from storage.
Unlisted share links
A share link is unlisted: anyone who has the link can watch the video, and search engines are asked not to index it. Workspace owners, admins and the video's creator can revoke a link at any time, and the page then stops working.
Subprocessors
Videos and files are stored in Cloudflare R2. Our servers are hosted in Canada (OVH, Beauharnois).
| Provider | Purpose |
|---|---|
| OpenAI | AI models for planning, scripting, the browser agent and visual quality checks, and automated content safety checks of each video's title, narration (or on-screen labels) and share texts |
| Anthropic | Configured as the alternative provider of the AI models for planning, scripting, the browser agent and visual quality checks; we can switch to it, but don't use it today |
| ElevenLabs | Voice narration |
| Cloudflare | Object storage (R2) and DNS |
| Resend | Transactional email |
| Stripe | Payments, sales tax, invoices and receipts |
| Optional "Sign in with Google" | |
| OVH | Application hosting in Canada (Beauharnois, Quebec) |
Report a vulnerability
Email security@clipyoursaas.com. We read every report.