Security at VidForgeX

At VidForgeX, security is not an afterthought — it is a foundational principle woven into every layer of our platform. We recognize that our customers entrust us with sensitive media and operational data, and we take that responsibility seriously.

We employ a defense-in-depth strategy that combines technical safeguards, organizational controls, and continuous monitoring to protect against unauthorized access, data loss, and emerging threats. Our security practices are designed to meet the expectations of enterprise customers and are regularly reviewed and improved as our platform evolves.

Our team actively monitors the threat landscape and invests in proactive measures — including secure development practices, automated vulnerability scanning, and incident response planning — to ensure that our security posture remains robust and current.

The VidForgeX platform is hosted on enterprise-grade cloud infrastructure provided by industry-leading vendors. Our infrastructure providers maintain rigorous compliance certifications and undergo regular independent audits.

Our infrastructure security measures include:

• Compute and storage resources hosted in secure, geographically distributed data centers with physical security controls including biometric access, 24/7 surveillance, and environmental protections
• Network-level isolation and segmentation to limit the blast radius of any potential breach
• Web application firewall (WAF) and distributed denial-of-service (DDoS) mitigation to protect against external threats
• Automated infrastructure provisioning using infrastructure-as-code principles, reducing the risk of configuration drift and human error
• Regular patching and updates applied to all system components, with critical vulnerabilities addressed on an expedited basis
• Continuous monitoring and alerting for anomalous activity, performance degradation, and security events

Production environments are strictly separated from development and staging environments. Access to production systems is limited to authorized personnel and governed by the principle of least privilege.

Encryption is a cornerstone of our data protection strategy. We apply strong encryption to data both in transit and at rest to ensure that your information remains confidential and protected from unauthorized access.

In Transit

• All communications between your browser and the VidForgeX platform are encrypted using TLS 1.2 or higher
• API calls, file uploads, and media streaming are transmitted exclusively over encrypted connections
• Internal service-to-service communication within our infrastructure is also encrypted to prevent interception at any layer

At Rest

• All stored data — including uploaded media files, analysis results, account information, and database records — is encrypted using industry-standard server-side encryption
• Encryption keys are managed through dedicated key management infrastructure with strict access controls and automatic key rotation
• Backup data is also encrypted at rest, ensuring protection throughout the entire data lifecycle

VidForgeX enforces strict access controls at every level of the platform to ensure that only authorized individuals can access data and functionality appropriate to their role.

Authentication

• User passwords are cryptographically hashed using modern, salted hashing algorithms — plaintext passwords are never stored
• Support for multi-factor authentication (MFA) to add an additional layer of account protection
• Session tokens are short-lived and automatically expire after a period of inactivity
• Third-party single sign-on (SSO) integration is supported, allowing organizations to use their existing identity provider

Authorization

• Role-based access control (RBAC) with a defined role hierarchy — each user is granted the minimum set of permissions necessary for their function
• Organization-scoped data isolation ensures that users in one organization cannot access data belonging to another
• Row-level security policies are enforced directly at the database layer, providing an additional safeguard beyond application-level checks
• Sharing and collaboration features use explicit permission grants — data is private by default and only accessible to those explicitly authorized

Internal Access

• Employee access to customer data is restricted to essential personnel and governed by the principle of least privilege
• All administrative access is logged and subject to periodic review
• Access to production systems requires strong authentication and is limited to authorized operations personnel

You retain full ownership of all media and content you upload to VidForgeX. We do not claim any intellectual property rights over your uploaded content, and we do not use your data for purposes unrelated to providing and improving the Services.

• Uploaded media is processed solely on your behalf and for the purpose of delivering analysis results to you and your authorized team members
• Your content is never shared with other customers or third parties for their independent use
• We do not use your uploaded media to train AI or machine learning models without your explicit, separate consent
• Analysis outputs and insights derived from your content belong to your organization and are not used to build shared or cross-customer models

Our data handling practices are described in detail in our Privacy Policy, which governs the collection, use, and protection of personal information across the platform.

VidForgeX uses artificial intelligence and machine learning to analyze uploaded media and generate actionable insights. We are committed to processing your content responsibly and transparently.

• AI processing is performed in secure, isolated compute environments with strict access controls
• Media is processed only when you explicitly initiate an analysis — content is not automatically scanned or analyzed without your instruction
• AI models used for analysis are general-purpose and are not trained on individual customer data unless explicit consent is provided
• Analysis results are generated in real time and delivered directly to your account — intermediate processing data is not retained beyond the analysis session
• We continuously evaluate our AI systems for accuracy, fairness, and reliability, and we apply human oversight where appropriate

Where third-party AI services are used as part of the analysis pipeline, data is transmitted securely and processed under strict data processing agreements that prohibit the use of your content for any purpose other than providing the requested analysis.

We retain your data only as long as necessary to provide the Services or as required by applicable law. You have full control over your content throughout its lifecycle on the platform.

• You can delete individual uploads, analysis results, and other content at any time through the platform interface
• Deleted items may be temporarily retained in a recoverable state for a short grace period to protect against accidental deletion, after which they are permanently removed
• When content is permanently deleted, all associated analysis results and derived data are also removed from active systems
• Residual copies in automated backups are overwritten in the normal course of our backup rotation cycle

Account Deletion: You may request complete deletion of your account and all associated data by contacting us at [email protected]. Upon verified deletion, your profile, organization data, media, analysis results, and configuration will be permanently removed, subject only to minimum legal retention requirements.

Account deletion requests are processed within 30 days. You will receive confirmation once the process is complete.

We value the work of independent security researchers and the broader security community in helping us maintain the safety of the VidForgeX platform and our users' data.

If you believe you have discovered a security vulnerability in our platform, we encourage you to report it to us responsibly. When reporting, please:

1. Send your report to [email protected] with a clear description of the vulnerability, including steps to reproduce if possible
2. Allow us a reasonable period of time to investigate and address the issue before making any public disclosure
3. Avoid accessing, modifying, or deleting data belonging to other users during your research
4. Refrain from actions that could degrade, disrupt, or damage the platform or its users' experience

We are committed to acknowledging valid reports promptly, working with researchers in good faith, and keeping you informed of our progress toward a resolution. We will not take legal action against individuals who report vulnerabilities in compliance with these guidelines.

If you have security concerns, questions about our security practices, or need to report a vulnerability, please contact our security team. We aim to acknowledge all security-related inquiries within 2 business days.