The controls visible in the current product and the practices customers should use with recorded workflows.
Accurate by design: this page describes implemented controls without claiming unverified certifications, physical hosting regions, universal encryption properties, or zero-retention guarantees.
1. Security approach
IPPO applies layered controls across identity, tenant and project authorization, capture ingestion, background processing, guide editing, export, billing, and sharing. Security is shared: IPPO protects the Service, while customers decide what to record, who belongs in a workspace, and how guides are shared.
2. Identity and access
Control
Current implementation
Authentication
Clerk manages user authentication and sessions. Protected application routes require an authenticated user.
Tenant isolation
Server-side context and authorization checks scope application operations to the current tenant and workspace.
Project roles
Project membership and roles govern viewing, editing, inviting, publishing, and administrative actions.
Enterprise administration
Domain, membership, access-grant, and policy controls support managed enterprise access.
Extension access
Extension tokens are random credentials stored server-side as hashes, have an expiry, and can be invalidated.
Developer and maintenance access
Sensitive administration routes use separate authorization checks and are not part of normal-user navigation.
3. Content, history, and sharing
Customer content is stored under tenant, project, capture, video, or guide identifiers rather than a single public namespace.
Guide changes and security-relevant actions can create version or audit records so authorized users can understand what changed.
Share links support active/revoked state, optional expiry, password protection, and download or print controls.
Share-link passwords are protected with a salted scrypt hash. A successful password check creates an HttpOnly, SameSite=Lax verifier cookie; the password itself is not stored in that cookie.
Removing a share link disables access while allowing a limited audit record to remain.
Screenshot tools allow authorized editors to crop, annotate, blur, and redact evidence before publication.
4. Application and operational safeguards
Secrets for providers and deployment services are intended to remain server-side and are not exposed in public client configuration.
Public and sensitive API routes apply request validation, authorization, rate limits, or signed-webhook verification according to risk.
Background AI and export work uses job identifiers, tenant and project context, status records, and bounded processing paths.
Structured application logging uses correlation identifiers rather than intentionally placing full Customer Content in routine log context.
Metrics record operational values such as duration, failures, counts, and measured AI cost; they are not designed as advertising profiles.
Public outbound fetching rejects private and internal network destinations to reduce server-side request-forgery risk.
Guide-generation prompts instruct the system not to reproduce literal typed values such as passwords, email addresses, or other captured field contents in generated instructions.
5. AI and service providers
Selected frames, screenshots, text, and workflow context can be sent to Google Gemini when an authorized user requests AI processing. Google’s handling depends on the applicable service terms and production account configuration. IPPO does not claim zero retention unless it has been specifically enabled and confirmed.
Clerk processes identity and session data, Stripe processes payment and billing data, and Microsoft 365 may process transactional email data. Deployment infrastructure can include Convex-compatible data storage, S3-compatible object storage, and Redis-compatible queues. See the Privacy Policy for disclosure details.
6. Customer responsibilities
Record only authorized systems and notify people where required.
Keep credentials, authentication codes, payment data, and private keys out of recordings.
Use least-privilege roles, review workspace membership, and remove access promptly when responsibilities change.
Review AI output and visual evidence before approval or publication.
Use passwords and expiry for sensitive share links, send links through an appropriate channel, and revoke links when no longer needed.
Export and store downloaded files according to your organization’s security and retention rules.
Report suspected compromise promptly and avoid including secrets in the report.
7. Incidents and security reporting
Report a suspected vulnerability, unauthorized access, exposed token, or security incident to [email protected]. Include the affected route or feature, reproduction steps, impact, and a safe way to contact you. Do not access other users’ data, disrupt the Service, or publicly disclose an unresolved issue.
IPPO will assess credible reports, contain confirmed issues, preserve relevant evidence, and notify affected parties or authorities when required by applicable law and the facts of the incident.
8. Assurance boundaries
This page is a product-security overview, not a certification report, penetration-test result, or guarantee that an incident cannot occur. IPPO does not claim SOC 2, ISO 27001, a fixed data-residency region, blanket encryption at rest, or zero-retention AI processing unless those commitments are documented for a specific deployment or contract.
Enterprise customers can contact [email protected] to request deployment-specific security information and contractual documentation.
