Security and compliance.

The underlying platform is independently audited and operates under a published set of legal agreements.

• ISO 27001 certified information security management.
• PCI DSS, with the cloud environment passing an annual QSA audit.
• GDPR compliant, with a data processing agreement and cross-border transfer terms.
• Legal agreements covering a master services agreement, data processing, service specifications, service level agreements, acceptable use, privacy, copyright, service abuse, and DSA transparency reporting.

SOC 2 and ISO 27017/27018 are not currently listed. Current certificates, audit scope, and reports are available on request under NDA.

Network and application attacks are absorbed across a global edge with 200+ Tbps of filtering capacity, mitigating volumetric attacks above 1 Tbps. Protection spans layers 3, 4, and 7, with always-on mitigation for advanced plans, BGP and GRE traffic redirection, and anycast routing.

Cache-busting attacks, which force origin fetches by making every request unique, are the highest-impact application-layer threat to a video platform. Mitigation is inline and automatic rather than a manually triggered mode, and event logs are retained for review.

A web application and API protection layer covers the login, search, media, creator, messaging, and payment surfaces.

• WAF with OWASP-style rules, behavioral detection for brute force, probing, and obfuscated attacks, and custom rules with allow, block, captcha, and tag actions.
• Rate limiting, IP allow/deny lists, and IP reputation for proxies, VPNs, hosting ranges, and known malicious bots.
• JA3/JA4 TLS fingerprinting to identify clients that rotate addresses.
• API discovery and protection with authentication-token protection and sensitive-data exposure detection.
• Bot management with a known-bot allowlist and headless-browser and anti-scraping detection.

A data processing agreement forms part of the master services agreement and defines processor and controller roles, sub-processing, and cross-border transfer terms. Personal data is retained for the term of the agreement plus ten years where required by data protection law.

Workloads run across regions in the Americas, EMEA, and APAC, with regional placement available for data-residency requirements. Customer accounts are subject to KYC verification, and access to account details is restricted internally.

Abuse is handled under a published service abuse policy and copyright policy, with a dedicated abuse reporting channel and transparency reporting aligned to the EU Digital Services Act. The platform operates as an intermediary and acts expeditiously on valid reports.

Incident response, logging, and escalation are defined in the service specifications. Security reports, monitoring details, and documentation are available through the trust center on request.

Read the service commitments and support response times

Service commitments and support

The full infrastructure platform

CDN platform and edge security

Privacy policy