1. Security approach
Editing App uses layered administrative, technical, and organisational safeguards appropriate to a private creative workspace. Measures include access controls, private project access, limited-duration media delivery, account confirmation for destructive actions, restricted administrative access, payment handling by a dedicated payment provider, and operational monitoring.
This page intentionally omits credentials, internal addresses, system topology, account identifiers, security rules, and detailed defensive configuration. No internet service is perfectly secure, and this overview is not a certification, audit report, or guarantee against every threat.
2. Protecting your account
- Use a unique password and protect the email account used for sign-in.
- Use only trusted devices and networks for confidential creative work.
- Do not place passwords, access credentials, or full payment details in prompts, filenames, project names, or support messages.
- Review account, billing, and generated content regularly and report unexpected activity promptly.
- Delete projects and outputs when they are no longer needed and permanently delete the account when you no longer require the Service.
3. Reporting a vulnerability
Send a concise report to legal@editingapp.live with the subject “Security disclosure.” Include the affected page or feature, a clear impact statement, reproducible steps, and supporting screenshots or logs with personal information removed. Do not include credentials, unrelated customer data, or confidential media.
We aim to acknowledge a credible report, assess severity, and communicate material progress when contact information is available. Response timing depends on impact, complexity, provider coordination, and the quality of the report.
4. Research rules
- Use only accounts and content you own or have explicit permission to test.
- Stop immediately if you encounter another person’s data and report what happened without retaining, downloading, or disclosing it.
- Do not use denial of service, destructive testing, social engineering, spam, automated high-volume traffic, physical attacks, or provider-credential testing.
- Do not alter, delete, encrypt, publish, or exfiltrate data, and do not demand payment or threaten disclosure.
- Give us a reasonable opportunity to investigate and remediate before public disclosure.
Good-faith research that follows these rules will not be treated by Editing App as malicious access. This statement cannot authorise testing of third-party services or excuse conduct prohibited by law.
5. Security incidents
If we confirm a security incident affecting personal information, we will investigate, contain and remediate it, coordinate with relevant providers, and notify affected people or authorities when required by law. Notices will avoid details that would create additional security risk.