Security and data flow
Media2Text is designed to minimize the media sent for transcription. For supported videos, the browser prepares an audio track locally and does not upload the original video. Prepared audio and transcript artifacts use private storage with short-lived, object-specific access.
Scope: this page documents controls implemented in the current product architecture. It does not claim a third-party security certification or guarantee absolute security.
What happens to a supported video
- The browser checks the file. It verifies that a playable audio stream is present. A video with no audio fails before an upload is created.
- The browser prepares audio locally. The original video remains on the device; there is no server-side fallback that uploads the complete video.
- Prepared audio is uploaded. The browser receives short-lived multipart upload URLs restricted to the intended private object and operation. Permanent storage credentials are not sent to the browser.
- Processing is account-scoped. The edge API records ownership and validates the caller, upload identifier, object key, size and content type before completion and task creation.
Private storage and service-to-service requests
Prepared audio and transcript artifacts are stored in a private object bucket. Browser and compute access is provided through short-lived presigned requests rather than a public bucket. Requests between the edge and the transcription compute service are signed over the request time, nonce, method, path and body hash.
Structured operational logs exclude presigned URLs, authentication tokens, filenames and transcript text. Large media bytes travel directly to private object storage; the edge API coordinates metadata and authorization rather than acting as a public file relay.
Account and session controls
- Passwords are derived with PBKDF2-HMAC-SHA-256 using a per-password salt and a server-side pepper.
- Session tokens are stored as hashes rather than as reusable raw tokens.
- Browser session cookies are marked HttpOnly, Secure and SameSite=Lax.
- Job, upload, folder, billing and settings operations derive the account from the verified session and check resource ownership.
- Users can view other active sessions and revoke sessions that are not the current one.
Browser and route protections
Production pages send HTTPS upgrade, HSTS, Content Security Policy, frame-denial, MIME-sniffing, referrer and permissions controls. Private application routes use noindex and private, no-store response directives. Unknown routes return an actual HTTP 404 instead of an indexable application shell.
Retention and deletion
Completed prepared playback audio is retained for up to 60 days unless the user deletes the original audio or the transcription sooner. Failed and no-speech inputs are removed when processing reaches its terminal state. Generated exports are designed to be regenerated or removed after seven days.
Deletion records the related private object keys in a durable deletion outbox before relational data is removed. Immediate cleanup and scheduled retries reduce the risk that a temporary storage failure leaves an orphaned user object.
Security limitations and responsible use
No online system can eliminate every risk. Users should protect access to their devices and accounts, verify they have permission to process a recording, and avoid uploading highly sensitive material when the residual risk is unacceptable. Automatic transcripts can also contain mistakes and should not be treated as a security- or safety-critical source of truth.
Report a security concern
Send a concise description, affected URL or feature, reproduction steps and expected impact to [email protected]. Do not include passwords, session tokens, private recordings or unnecessary personal data in the report.
For personal-data requests, use [email protected] and review the Privacy Policy.