Last Updated: 2026-05-29
We understand the critical importance of data security. This document details the technical measures and organizational practices UnMark employs to protect user data and system security.
All user data is encrypted during transmission using TLS 1.3 protocol. Data at rest uses AES-256 standard encryption. Database connections use SSL/TLS encrypted channels. API keys and sensitive configurations are managed via environment variables and never hardcoded in the codebase.
UnMark is hosted on industry-leading cloud infrastructure whose providers maintain SOC 2 Type II compliance certification. Servers are deployed across multiple availability zones for disaster recovery, with regular automated backups to offsite storage. A Web Application Firewall (WAF) protects against common attacks including SQL injection, XSS, and CSRF.
We implement the Principle of Least Privilege. Production databases and servers are accessible only by authorized operations personnel via SSH keys plus multi-factor authentication (MFA). Employee access to production data requires approval workflows, and all actions are recorded in audit logs. Passwords are stored using bcryptjs hashing.
We deploy real-time security monitoring systems that track abnormal logins, unusual traffic patterns, and suspicious API calls 24/7. Regular penetration testing and code security scans are conducted. Dependency vulnerabilities are continuously detected via automated tools and promptly updated.
User-uploaded video files are processed in isolated environments. Original files and intermediate artifacts are automatically deleted after processing completion. File transfers are fully encrypted throughout, and temporary file retention does not exceed 72 hours. Execution of code within uploaded files is strictly prohibited to eliminate malicious file exploitation risks.
In the event of a security incident, we commit to notifying affected users within 72 hours of confirmation. We will cooperate with relevant regulatory authorities in investigations and publish transparent post-incident reports. If you discover any security issues, please report immediately to security@mail.unmarkvideo.com.
UnMark values the security research community. We invite responsible disclosure of security vulnerabilities through our Vulnerability Disclosure Policy. We are committed to working with researchers to protect our users' data and privacy.
This policy applies to the following UnMark-owned assets and services:
The following are out of scope and not eligible for submission:
If you believe you have discovered a security vulnerability, please follow these steps:
Email security@mail.unmarkvideo.com with a detailed description of the vulnerability, including steps to reproduce, potential impact, and any proof-of-concept code.
Please do not publicly disclose the vulnerability until we have had sufficient time to investigate and remediate. We commit to a 90-day coordinated disclosure timeline.
Include a secure method for us to contact you (PGP key preferred) for follow-up questions and coordination during remediation.
We will keep you informed of our progress and may request additional information or testing assistance to verify the fix.
24h
Initial acknowledgment of your report
72h
Preliminary assessment and severity classification
90d
Target remediation timeline (severity-dependent)
UnMark will not pursue legal action against security researchers who act in good faith, comply with this policy, and do not violate the law or access user data without authorization. We consider good faith to include: (1) reporting vulnerabilities promptly, (2) avoiding privacy violations, (3) not degrading service availability, and (4) coordinating with us on public disclosure.
