Security and responsible disclosure
Effective 1 August 2026. EgaClip uses layered controls for accounts, payments, media, generation workers, and audit records.
Account and access controls
EgaClip supports protected sessions, password rotation, passkeys on compatible devices, role-based administration, and additional verification for sensitive actions. Never share a password, mailbox credential, private key, or one-time code with support.
Media and production controls
Uploads and generated assets are accessed through authorised application paths. Retention schedules, archive state, legal holds, dependency checks, and audit events govern deletion rather than silent quota cleanup.
Payments and financial records
Payment providers process complete card details. EgaClip stores provider references, receipts, entitlement history, reconciliation records, and immutable compensating ledger events needed to operate the account and respond to disputes.
Incidents
EgaClip investigates suspected compromise, preserves relevant evidence, contains affected access, restores service, and notifies affected parties when required. Current public availability is shown at /status/.
Report a vulnerability
Send a concise report to support@egaclip.com with the subject Security disclosure. Include the affected URL, reproduction steps, impact, and safe evidence. Do not access other users' data, degrade service, or publish an unremediated issue.