Security
Your footage is the most private thing you give us.
GambitClip is a small team. We are not going to show you a wall of certification logos; we are going to tell you what actually happens to your data and let you judge. The commitments below are the same ones written into our Data Processing Agreement, so a business customer can hold us to them.
Encrypted everywhere
TLS between your browser, our service and every provider; encryption at rest for storage and the database.
Footage has a short life
Your video is kept 7 days after a run so you can adjust your cuts, then deleted automatically. Clips are kept 30 days, then deleted.
No training on your content
Every AI provider is used on terms that forbid training on customer content, and our routing refuses providers that retain inputs.
One job, one box
Each run executes in its own container with its own working files. Nothing from one run is visible to another.
Few hands, all with keys
Production access is limited to the people who run the service, behind multi-factor authentication, with secrets in the hosting providers' secret stores, never in code.
Errors without footage
Error monitoring carries your account identifier and technical details only. Logs are kept 90 days.
Named providers, dated list
Every company that handles your data is on our subprocessor page, under a data processing agreement, with its location.
Payments we never see
Stripe handles cards and invoices. We store no card numbers.
Your account
Sign-in is handled by Clerk with the usual protections: hashed credentials, rate limiting, and sign-in with Google or email codes so there is no password to leak. If you connect YouTube, we hold only the permission to upload the clips you choose, and you can revoke it in your Google account at any time. You can download everything we hold about you and delete any run or your whole account from the app.
If something goes wrong
We keep a written incident procedure: contain, assess, notify. If a breach affects your data we tell you and, where the GDPR requires it, the Swedish Authority for Privacy Protection, within 72 hours of confirming it, with what happened, what it means for you and what we did.
Reporting a vulnerability
If you find a security problem in GambitClip itself, email hello@gambitclip.com with the subject "Security issue" and enough detail to reproduce it. We answer within two business days and keep you informed until it is fixed. We ask that you do not access other people's data beyond what proving the issue requires, that you do not disrupt the service, and that you give us reasonable time to fix before publishing. Researchers who follow this will not face legal action from us for their research; we do not run a paid bounty programme yet. The machine-readable version of this is our security.txt. To report abuse or harmful content rather than a vulnerability, use the report page.
What we do not have yet
No SOC 2 or ISO 27001 audit. We will pursue one when the size of the business justifies it, and we will say so here when it is done. Until then this page, the DPA and the subprocessor list are the documentation, and we answer security questionnaires from business customers on request.