Security at VeoRec
Last updated: October 30, 2026
What VeoRec does to protect your videos and your account today, and what it does not do yet. Each statement here was checked against the code that runs VeoRec and the headers our servers send.
Found a security problem? Email [email protected].
Encryption in transit
- veorec.com and api.veorec.com are served over HTTPS only, and plain http:// addresses redirect to https://
- Both send a Strict-Transport-Security (HSTS) header for one year, including subdomains, so browsers refuse to connect without HTTPS
- veorec.com sends a Content-Security-Policy: scripts run only from veorec.com and a short list of named services (Cloudflare, Google sign-in and the Paddle checkout), and other sites cannot frame our pages, except the player made for embedding
- The API sends a locked-down Content-Security-Policy and refuses to be framed
- Video and image files are served through signed links that expire, after 10 minutes for any video that is not public
Where your data is stored
- Recordings, thumbnails and captions are stored in Cloudflare R2, which encrypts every stored object at rest
- The app servers and the database run on Railway
- The website is hosted on Cloudflare
- There is no choice of data region yet
Signing in
- Passwords are stored only as bcrypt hashes, never as the password itself
- You can sign in with Google instead of a password
- Each signed-in browser, extension or phone has its own session, which expires after 30 days; you can see your sessions and sign them out from your account
- Sign-up, sign-in and password resets are rate limited
Who can open your videos
Your recordings are private to your account until you share a link. For each video you choose who can open it:
- Only people I share with: nobody else can open the link
- Anyone with the link: not listed anywhere; the link is enough
- Signed-in users only: any VeoRec account with the link
- Public: anyone with the link, and link previews show the video
- Team members only (Business): people in the recording's team workspace
- Password protected (Pro and Business): viewers type the password you set; we store only a salted hash of it
Deleting videos and your account
- Deleting a video moves it to your trash, where you can restore it. After 30 days in the trash, its files are deleted from storage, together with its comments, views and leads
- You can delete your account yourself in your account settings, by typing your email to confirm. You are signed out everywhere at once and have 14 days to cancel
- After those 14 days, your recordings are deleted (their files within a further 30 days), and connected drives, API keys and webhooks are removed. Comments you left on other people's videos stay, shown as a deleted user
- Basic account details may remain in a deactivated record; email us and we will erase them
Staff access
- Only a short allowlist of VeoRec administrator accounts can use the admin tools
- To help with a support request, an administrator can open a "Login as user" session. It needs a written reason, lasts 30 minutes, is written to an audit log, and cannot change billing, the password or sign-in email, payouts, or delete anything
- Opening a recording that is not public or unlisted in the admin tools is written to an audit log, and admin views never count as views
- Changes an administrator makes to accounts and recordings are written to an audit log
Who processes data for us
Cloudflare (storage in R2 and the website), Railway (servers and database), Groq (transcription, and AI titles, summaries, chapters and translations from the transcript), Brevo (account emails), Paddle (payments, as merchant of record) and Google (Google sign-in, and the web fonts on our pages). The Privacy Policy has the details.
What we do not have yet
- VeoRec is not SOC 2 audited
- There is no single sign-on (SSO or SAML) yet
- There is no two-step verification for password sign-in yet; signing in with Google uses your Google account's own protection
- There is no choice of data region yet
Reporting a security problem
Email [email protected] with "Security" in the subject and the steps to reproduce it. Please give us a reasonable time to fix it before you make it public, and do not access other people's data or disrupt the service while you test. Our security.txt file is at /.well-known/security.txt.