Where your video lives, and who can reach it

Where your files live

Sources and HLS/DASH outputs assigned to connected customer storage are written to the selected customer provider. Files for a free account without connected storage use NULX-managed storage. NULX separately retains metadata needed for processing, playback, and billing.

• When media in connected customer storage is transcoded, a NULX worker reads the source through a scope- and time-limited signed URL and processes it in temporary workspace.
• Results for connected customer storage are written back to that provider. This description does not apply to an account that has not connected storage.
• All traffic is HTTPS only. HSTS is set for two years including subdomains, so a browser that has seen the site once will not fall back to HTTP.

Credentials and connection scope

Storage credentials and delivery signing keys are encrypted in the database with Active Record Encryption and are never shown again after saving.

• Setup asks for a bucket-scoped R2 token limited to the prefix you choose, not an account-wide key.
• Revoking the token in your own Cloudflare account prevents NULX from making new requests with that credential. Previously issued signed URLs or cached responses can continue until their own expiry or retention time.
• A connection can be marked read-only, in which case NULX will read from it but never delete objects in it.

Signing in

Email one-time codes are the primary sign-in path; Google sign-in is available where configured. There are no long-lived shared passwords for the dashboard.

• A code is six digits, expires after 10 minutes, and allows at most 5 attempts. Requesting a new code invalidates the previous one.
• The authentication record stores only a bcrypt digest, not the code itself. The one-time code is temporarily handled by the email-delivery job.
• Sessions end after 14 days without use, and after 90 days regardless of use.
• Session cookies are Secure, HttpOnly, and SameSite=Lax.

Protected playback

Public playback requires an explicitly configured path or domain; R2 buckets are private by default. Video that should not be public is served through expiring signed paths instead.

• A signed playback URL is valid for 30 minutes by default, and the player refreshes it before it expires so a viewer is not interrupted.
• Signing happens per asset. A link that leaks stops working when it expires rather than exposing the bucket.
• General pages use a per-response Content-Security-Policy nonce and object-src none. Player, embed, and share pages set frame-ancestors from the customer's allowed domains, or the embedding default when no allowlist is configured.

Automatic captions and external transfer

Automatic captions are off unless you enable them for an upload. When enabled, a low-bitrate audio extract - not the video file - is sent to Cloudflare Workers AI. When you request a subtitle translation, only the subtitle text is sent to OpenAI in the United States.

• The upload screen states this transfer before processing starts, so it is never a silent export.
• NULX hosting infrastructure temporarily processes media during managed work. Cloudflare Workers AI additionally processes the audio extract only when automatic captions are enabled.

Deleting video

Deleting a video moves it to Trash and schedules the objects in your bucket for permanent removal after 30 days, so an accidental deletion can be undone.

• An account owner can permanently delete immediately from Trash instead of waiting out the retention window.
• On a read-only connection, deletion removes the video from NULX but deliberately leaves the objects in your bucket - only you can remove those.
• Permanent deletion never touches an object still referenced by another asset.

The exact permissions NULX needs

These are the S3-compatible operations used when you manually connect an existing bucket. That connection token can be scoped to this list, and a read-only connection uses the read set alone. Automatic setup uses a separate parent token to create a dedicated bucket, restricted token, and playback settings, and may delete resources it created during rollback or customer-requested cleanup.

• Read: GetObject, HeadObject, ListBucket (restricted to the prefix you choose).
• Write: PutObject, CreateMultipartUpload, UploadPart, CompleteMultipartUpload, AbortMultipartUpload.
• Delete: DeleteObject, used only when you delete an asset on a read-write connection.
• Not requested from a manual connection token: account-level operations, bucket creation or deletion, IAM or token management. Review the separate scope and impact of an automatic-setup parent token on the connection screen.

What happens during managed encoding

The steps in which a NULX worker handles media assigned to connected customer storage. An account without connected storage uses NULX-managed storage.

• 1. A source assigned to connected customer storage is written directly to your bucket under your prefix.
• 2. A worker is issued a time-limited signed URL for that single object - not your credentials.
• 3. The worker transcodes to an HLS rendition ladder on its own disk.
• 4. The output is written back under your prefix, and the worker's local copies are deleted when the job ends.
• 5. With connected customer storage, NULX retains job metadata (duration, sizes, status) and no separate permanent media copy.

API keys

Keys authenticate machine access to your tenant. They are scoped, revocable, and never recoverable after issue.

• Only a SHA-256 digest is stored. The key is displayed once at creation and cannot be shown again - if it is lost, revoke it and issue another.
• Scopes are explicit per key (assets, playback, billing, storage, webhooks, api_keys) rather than one all-powerful token.
• A key can be given an expiry at creation, and revocation takes effect immediately.
• Issue and revocation are recorded in the audit trail.

Audit trail and reporting

Security-relevant events are recorded: sign-ins, API key issue and revocation, plan changes, storage connection changes, and operator actions.

• Report a suspected vulnerability to contact@nulx.dev. Contact details are also published at /.well-known/security.txt.
• NULX does not currently hold a SOC 2 or ISO 27001 certification, and does not claim one. This page describes the controls that are actually in place.