distrorig encrypts your product logins and social account tokens at rest, keeps your media in a private bucket served only through signed links, and runs production apart from development. The AI agent uses its own browser on our machines, not yours. To report a security issue, email legal@distrorig.com.
How are my product logins protected?
The login you give for your product is encrypted at rest with AES-256-GCM. So are the tokens for your connected TikTok and YouTube accounts. The keys are kept in a secrets manager, apart from the database.
The AI model that decides the agent's next step does not see your password. It asks for the login by a placeholder, and the browser fills in the real value.
We still ask you to use a test or demo account where you can. Give it sample data and only the access the video needs.
Where does the AI agent run?
The agent runs in its own browser on our machines. It never runs on your computer or in your browser. It opens your product, signs in with the login you gave and does the steps your video shows. You can watch it live and stop it in the chat.
Who can see my videos and files?
Your recordings, stills, clips, voiceovers and exports are stored in a private bucket. They are not public. When you open one, distrorig checks that it belongs to your workspace and then gives your browser a signed link that expires.
You sign in with Google. distrorig never sees your Google password.
Are development and production separate?
Yes. Development and production run in fully separate environments, each with its own database, sign-in and storage. Every process checks at start that it can reach only its own environment, and stops if it can reach the other one.
How long is data kept?
| Data | Kept for |
|---|---|
| Finished background jobs | 90 days |
| The steps inside those jobs | 30 days |
| Timeline versions | 90 days, beyond a project's latest 50 versions |
| Library items and exports | Until you delete them |
| Your account | Until you ask us to delete it |
What happens when I delete something?
- A library item: its files are deleted.
- A project: its exports' files are deleted.
- Your account: email legal@distrorig.com from the address you sign in with.
Do you use trackers?
No. distrorig sets no ad trackers and no analytics cookies. Your video's views come from TikTok and YouTube, not from tracking on our site.
How do I report a security issue?
Email legal@distrorig.com with:
- what you found and where (the page or address),
- the steps to reproduce it,
- what an attacker could do with it.
Please do not access other people's data, and give us time to fix the problem before you share it. We will reply by email.
What certifications do you have?
None today. distrorig does not hold SOC 2, ISO 27001 or any other security certification. This page describes the measures we take.