Security

How we protect your account, your stories and your connected channels, and how to tell us if something looks wrong.

Last updated October 23, 2026

1. Our approach

Your stories, generated media and connected channels are valuable, so we build with the assumption that every request could come from someone else. This page describes what we do today. It is a description, not a certification: we have not claimed an independent security audit such as SOC 2 or ISO 27001.

2. Your account and your data

Sign-in is handled by a dedicated authentication provider. We never see or store your password.
Ownership checks. Every request for an episode, a media file, a job, a connected account or analytics is checked against the signed-in owner before anything is returned. One user cannot reach another’s content.
Private by default. Stored media is served only through authorized paths. A video is public only after you publish it to a platform yourself.
Upload checks. Files we store are validated by type and size.

3. Connected YouTube and Instagram accounts

We ask only for the permissions needed to upload or post what you approve and to read performance numbers.
Access tokens are stored encrypted, never in plain text.
Disconnecting deletes the stored token. Publishing and connection actions are written to an audit log.

4. Platform and infrastructure

Encrypted connections. All traffic uses HTTPS, with strict transport security in production.
Browser hardening. We use standard browser security protections.
Rate limits. Expensive actions are rate limited to prevent abuse.
Payments. Card details go straight to our payment processor. We never see them.
Managed providers. Data is stored and processed on established infrastructure providers, which encrypt data at rest and in transit under their own security programs.

5. How we keep it that way

Automated checks run on every change to catch missing access controls before release.
We review the permissions we request and the data we keep, and remove what we do not need.

6. Report a vulnerability

If you think you have found a security problem, please email security@reellytic.com. Include what you found, how to reproduce it, and any proof you can share safely.

We will acknowledge your report within three business days and keep you updated.
Please give us reasonable time to fix the issue before you share it publicly.
Please do not access other users’ data, disrupt the service, or run automated attacks or social engineering. Test only with your own account.
We will not take legal action against good-faith research that follows these rules.

We do not run a paid bounty program at this time, but we are glad to credit you if you wish.

7. What you can do

Protect your sign-in and turn on two-step verification in your account settings if it is offered.
Connect only accounts you own, and disconnect any you no longer use.
Tell us right away at security@reellytic.com if you suspect someone else has used your account.