In transit
Every connection to overreact.tv, to our API and to our real-time media endpoints uses TLS 1.2 or higher. HSTS is enabled on every domain we operate, so a browser that has seen us once will refuse to talk to us over plain HTTP again.
Authentication
Sign-in is handled by Clerk. We never receive or store your password. Session tokens are short-lived JWTs held in httpOnly, SameSite=Lax cookies scoped to our API domain, and state-changing requests carry a CSRF token.
Every API request is authorised against the account that owns the session it names. A valid token for one account cannot read another account’s recording, its assets or its usage.
Session and guest access
Every recording session is bound to a host. A guest joins through a single-use link that expires in 15 minutes and is consumed atomically when redeemed, so the same link cannot be replayed. Each participant gets a scoped token and a LiveKit access token that is valid for that session only.
At rest
Raw chunks, renders and exports live in Amazon S3 with server-side encryption (AES-256). Nothing in the bucket is publicly readable. Our services reach it through scoped IAM credentials, and every download you take is a presigned URL that expires in 15 minutes.
Deleting a session removes it from the app immediately and purges the underlying objects and their backup copies within 30 days.
Deletion is a security property too
On the Free plan, recordings and exports are permanently deleted 24 hours after they are created. That is by design — the smallest attack surface is the file that no longer exists — but it means you must download anything you want to keep before the countdown ends.
Paid plans keep your media until you delete it. Nothing on a paid account is ever auto-deleted, including when you hit your storage quota — a full quota pauses new uploads and renders instead. The full breakdown is in the privacy policy.
Infrastructure
The application runs in containers behind a reverse proxy that sets a strict Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff and HSTS. Secrets are injected at container start from an environment file that is never committed to source control, and access to production is limited to the people who operate it.
Monitoring and incident response
Application errors are captured with PII redaction, and we are paged on anomalous error rates and availability degradation. If we become aware of a security incident affecting your data we will tell you without undue delay and no later than 72 hours after we confirm it, consistent with applicable law. Live service health is on the status page.
Backups
Database backups run daily and are kept for 30 days. Media in S3 is replicated across availability zones. Backups are covered by the same deletion path as live data: when you delete something, it goes from the backups too, within 30 days.
Reporting a vulnerability
If you think you have found a vulnerability, email hello@overreact.tv with SECURITY in the subject line. Include a proof of concept and what an attacker could actually do with it. We acknowledge reports within 3 business days.
We ask two things in return: give us a reasonable window to fix the issue before you publish, and do not access, modify or exfiltrate anyone else’s data while investigating. Test against your own account. We will not pursue researchers who follow this.
Subprocessors and data location
| Subprocessor | What it does for us |
|---|---|
| Clerk | Authentication, sessions and account identity |
| LiveKit | Real-time media transport for guests and AirCam |
| Amazon Web Services (S3) | Object storage for raw chunks, renders and exports |
| Deepgram | Speech-to-text when you enable captions |
| Stripe | Payments, subscriptions and the billing portal |
Primary storage and compute are in the United States.