How we protect your account and your audio

Your audio files

• Uploads travel over HTTPS (TLS) and are stored in a private folder per job on our application server. Files are never publicly accessible; every download checks that it belongs to the signed-in account or a valid API key for that account.
• Originals and masters are deleted automatically 7 days after upload. You can delete any job's files immediately from your dashboard.
• Processing happens on our own server with open-source audio software (FFmpeg). Your audio is not sent to third-party AI services and is never used to train models.
• Metadata embedded in your upload (such as tags) is not copied into the mastered file.

Accounts

• Passwords are hashed with scrypt and a unique salt. We never store or see your password in plain text.
• Sign-in sessions use a random token in an HttpOnly, Secure, SameSite cookie; only a hash of the token is stored. Changing or resetting your password signs out every session.
• API keys are shown once and stored only as a hash. You can revoke them at any time.
• Sign-in, sign-up, password reset and contact endpoints are rate limited.

Payments

Card payments are handled entirely by Whop, Inc. ("Whop"), our payment processor. Card details are entered on Whop's secure checkout and never reach our servers. We receive only the confirmation needed to add minutes to your account (order ID, amount, currency, email).

Application security

• A strict Content Security Policy allows scripts only from our own domain (and the payment provider's checkout on the checkout page).
• HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and frame protection headers are set on every response.
• State-changing requests must come from our own origin, and payment webhooks are accepted only with a valid signature.
• Minute balances change only inside database transactions, with a ledger entry for every change.
• Database backups contain no audio, are readable only by the service account, and are rotated after 14 days.

Reporting a vulnerability

If you believe you have found a security issue, email contact@lufsready.com with the subject "Security". Please give us reasonable time to fix it before disclosure. We do not pursue good-faith research that avoids privacy violations and service disruption. Our security.txt has the same details.