Security

Production traffic uses encrypted connections. Service credentials and webhook destinations are kept in server-side configuration and are not shipped in public browser code. Inputs are validated at service boundaries, and visitor-facing errors avoid exposing operational details.

Access to transcripts, moderation reports and operational systems is restricted by role and purpose. Providers receive only the access needed to perform contracted functions. Access decisions and safeguards are reviewed as the service changes.

Automated and manual controls may detect abusive traffic, unsafe output and availability problems. We use bounded retries for critical internal delivery, rate controls where appropriate, dependency maintenance and recovery procedures. No security program can eliminate every risk.

Reports are triaged by severity and likely impact. Confirmed incidents are contained, investigated and corrected, with preservation of relevant evidence and notification to affected people or authorities where law requires.

Use the contact page with the affected URL, impact and reproducible steps. Do not access other people's data, disrupt the service, use destructive testing, publicly disclose an unresolved issue, or include private conversations unless essential to the report.

This statement is not a warranty, certification or invitation to test without authorization. It will be updated as protections and service providers change.