Where your video lives, and who can reach it

Where your files live

Permanent sources and HLS/DASH outputs are written to your own Cloudflare R2 bucket and stay there. NULX keeps the metadata needed to operate processing, playback, and billing.

• Managed transcoding is the only time a NULX worker holds your media, and it reads the source through a scope- and time-limited signed URL.
• Results are written back to your bucket. NULX keeps no second permanent copy of the video.
• All traffic is HTTPS only. HSTS is set for two years including subdomains, so a browser that has seen the site once will not fall back to HTTP.

Credentials and connection scope

Storage credentials and delivery signing keys are encrypted in the database with Active Record Encryption and are never shown again after saving.

• Setup asks for a bucket-scoped R2 token limited to the prefix you choose, not an account-wide key.
• Revoking the token in your own Cloudflare account cuts NULX off immediately. You do not need us to do it.
• A connection can be marked read-only, in which case NULX will read from it but never delete objects in it.

Signing in

Email one-time codes are the primary sign-in path; Google sign-in is available where configured. There are no long-lived shared passwords for the dashboard.

• A code is six digits, expires after 10 minutes, and allows at most 5 attempts. Requesting a new code invalidates the previous one.
• Only a bcrypt digest of the code is stored, never the code itself.
• Sessions end after 14 days without use, and after 90 days regardless of use.
• Session cookies are Secure, HttpOnly, and SameSite=Lax.

Protected playback

Public playback requires an explicitly configured path or domain; R2 buckets are private by default. Video that should not be public is served through expiring signed paths instead.

• A signed playback URL is valid for 30 minutes by default, and the player refreshes it before it expires so a viewer is not interrupted.
• Signing happens per asset. A link that leaks stops working when it expires rather than exposing the bucket.
• Content-Security-Policy is served with a per-response nonce, with object-src none and frame-ancestors limited to the site itself.

Automatic captions and external transfer

Automatic captions are off unless you enable them for an upload. When enabled, a low-bitrate audio extract - not the video file - is sent to Groq in the United States.

• The upload screen states this transfer before processing starts, so it is never a silent export.
• No other third party receives your media. See the compliance page for the full subprocessor list.

Deleting video

Deleting a video moves it to Trash and schedules the objects in your bucket for permanent removal after 30 days, so an accidental deletion can be undone.

• An account owner can permanently delete immediately from Trash instead of waiting out the retention window.
• On a read-only connection, deletion removes the video from NULX but deliberately leaves the objects in your bucket - only you can remove those.
• Permanent deletion never touches an object still referenced by another asset.

The exact permissions NULX needs

The S3-compatible operations NULX actually calls, so a token can be scoped to these and nothing more. A read-only connection uses the read set alone.

• Read: GetObject, HeadObject, ListBucket (restricted to the prefix you choose).
• Write: PutObject, CreateMultipartUpload, UploadPart, CompleteMultipartUpload, AbortMultipartUpload.
• Delete: DeleteObject, used only when you delete an asset on a read-write connection.
• Never requested: account-level operations, bucket creation or deletion, IAM or token management.

What happens during managed encoding

The one window in which a NULX worker holds your media, step by step.

• 1. You upload a source, which is written directly to your bucket under your prefix.
• 2. A worker is issued a time-limited signed URL for that single object - not your credentials.
• 3. The worker transcodes to an HLS rendition ladder on its own disk.
• 4. The output is written back under your prefix, and the worker's local copies are deleted when the job ends.
• 5. NULX retains metadata about the job (duration, sizes, status), not the media.

API keys

Keys authenticate machine access to your tenant. They are scoped, revocable, and never recoverable after issue.

• Only a SHA-256 digest is stored. The key is displayed once at creation and cannot be shown again - if it is lost, revoke it and issue another.
• Scopes are explicit per key (assets, playback, billing, webhooks, api_keys) rather than one all-powerful token.
• A key can be given an expiry at creation, and revocation takes effect immediately.
• Issue and revocation are recorded in the audit trail.

Audit trail and reporting

Security-relevant events are recorded: sign-ins, API key issue and revocation, plan changes, storage connection changes, and operator actions.

• Report a suspected vulnerability to contact@nulx.dev. Contact details are also published at /.well-known/security.txt.
• NULX does not currently hold a SOC 2 or ISO 27001 certification, and does not claim one. This page describes the controls that are actually in place.