Vistralo/Security
Security
This page describes how Vistralo handles your recordings, any AI provider keys you save and your share links, as the product works today. It lists what the software does. Where something has not been established, it says so.
What has not been audited
Vistralo is a new product run by a small team. It has not been through an independent security audit and holds no security certification. If your organisation needs one, Vistralo is not yet the right choice.
Your account
You sign in with an email address and a password. Sign-in is handled by Supabase, the service that also holds the database and the files. Your password is sent to Supabase's sign-in service and is never stored by the Vistralo app.
Recordings, screenshots and films
Everything you record or upload is stored in a private storage bucket, in a folder that belongs to your account. The database applies an access rule to projects, jobs and share links: a signed-in person can read and change only the ones they own. The database itself enforces the rule, whatever the app asks for.
To make a walkthrough, a worker on a server downloads the project's media, processes it and uploads the result. In the demo, nothing leaves your browser at all.
Your OpenAI and HeyGen keys
On the Free plan, AI narration runs on keys from your own accounts with OpenAI and HeyGen. On Pro and Studio it runs on Vistralo's own accounts, and you need no keys unless you choose to add yours. When you save a key, your browser encrypts it with the worker's public key before sending it. What is stored is the encrypted form. The worker that runs your jobs holds the matching private key and is the only thing that can open it.
Once saved, a key cannot be shown again, to you or to anyone using the app. You can replace it at any time. For jobs that run on your keys, you also set a spending cap for each job, between one cent and fifty dollars.
What is sent to the AI providers
- To write the narration, frames from your recording or screenshots are sent to OpenAI. For a website, the notes the worker took from the page's code go with them.
- To voice the narration, the text of the script is sent to HeyGen, and the audio that comes back is stored with your project.
When a job runs on your own keys, both happen under your accounts with those companies, so their terms with you apply. When it runs on the narration included in Pro or Studio, both happen under Vistralo's accounts with them. Either way, do not record anything you are not free to send to them.
Share links
A share link is read-only. It shows the project's video or its Visual brief and nothing else from the project. You choose when it expires, and you can remove it before then. Anyone who has the link can open it until one of those happens, so treat a link like the video itself.
The video on a shared page is served through a temporary signed address made when the page is opened. The stored file has no public address.
Website captures
When you ask for a website to be analysed, the worker opens it as an anonymous visitor. It accepts public web addresses only and refuses private network addresses such as localhost. It does not sign in anywhere on your behalf.
In your browser
The app runs under a content security policy that allows scripts only from Vistralo's own address and from Paddle, the payment provider, and does not allow inline scripts. Fonts are served from Vistralo. This website sets no cookies and loads no analytics or advertising scripts.
Payments
Paid plans are not open yet. When they are, payments will be handled by Paddle as the seller of the subscription. Card details will go to Paddle and will not pass through Vistralo.
What this page does not cover yet
Which countries the data is hosted in, how long deleted projects and backups are kept, and how data is encrypted while stored have not been written down and verified, so this page makes no statement about them. Ask if you need to know before you start.
Reporting a problem
If you have found a security problem, write to contact@vistralo.com with what you found and how to reproduce it. Please give us time to fix it before you publish. You will get a reply from a person.