Security at Cymatrax
How we protect your account and your audio.
Draft, pending review: Confirm every statement on this page against the production infrastructure before launch.
Your files
- Uploads are stored in private object storage. Nothing is publicly listed or shared.
- Playback and download links are signed and expire within minutes.
- Uploads are deleted when processing succeeds. If processing fails, the upload is kept 24 hours, then deleted. Processed files and previews are deleted after 7 days. You can delete a track sooner.
- Deleting your account deletes all of your stored audio.
Your account
- Passwords are stored as salted hashes, never in plain text.
- Optional two-factor authentication with any TOTP authenticator app, plus single-use recovery codes.
- Sign-in and sensitive actions are rate limited to slow down automated attacks.
Payments
- Card payments are handled by Stripe. Card numbers never touch our servers.
Infrastructure
- All traffic is encrypted with TLS (HTTPS only, with HSTS).
- Audio processing runs in an isolated service with no access to your account data.
- Administrative actions are recorded in an audit log.
Reporting a vulnerability
Please email security@cymatrax.com.