Hinto security and data protection

Does Hinto use my recordings to train AI?

No. We never train or fine-tune models on your content. Our AI provider is barred by contract from using it to improve its products, and it keeps requests for up to 55 days only to detect abuse. The temporary copy sent for analysis is deleted within hours, and by the provider after 48 hours at most.

Who can see my content?

• Projects are private by default: only you, your workspace owner and the people you share a project with can open it.
• Every request is authorised against your workspace and project membership before any data is read.
• Publishing is a separate, explicit step, and you can unpublish at any time.
• Authorised Hinto staff can open a workspace when needed to support you or keep the service secure.

How do I delete my data?

• Deleting a video removes the recording file permanently, and you choose whether the articles and images made from it are deleted too. Deleting an article is permanent. To delete a whole project or your account, email contact@hintoai.com.
• Backups are cleared on a rolling schedule.
• When a customer leaves, their data is returned or deleted as set out in the DPA.

What certifications does Hinto have?

Hinto (Vertex Tree Ltd) is Cyber Essentials certified, an independent certification of baseline security controls, issued by IASME. Need our DPA or a completed security questionnaire? Email security@hintoai.com.

We are registered with the UK Information Commissioner under reference ZC247096, and we have an EU representative under GDPR Article 27, named in our privacy policy.

How is my data protected?

• Stored videos and documents are encrypted at rest with AES-256.
• Backups are encrypted with AES-256 under a key we hold.
• Connections use TLS 1.2 or higher.
• Your database records and uploaded files are stored with a managed provider in the European Union.
• The providers we use, with their locations, are listed on the sub-processors page.

Account and admin controls

• Sign in with email and password or with Google. Two-factor authentication with any authenticator app is available to every account. On All-Inclusive and Custom plans, workspace owners can require it for all members.
• You can sign out of every other device from your account security page.
• API keys belong to one project, carry the scopes you choose, are shown once and can be revoked at any time. Webhooks are signed with a per-project secret.
• Sign-ins, two-factor events, membership and role changes, sharing, API keys, webhooks, publishing, deletions, exports and billing events are recorded in an append-only audit log kept for 400 days. On All-Inclusive and Custom plans, workspace owners can filter it and download it as CSV.

Incident notification

If a security incident affects your data, we notify you without undue delay, as set out in our Data Processing Agreement.

Reporting a vulnerability

If you believe you have found a security issue in Hinto, email security@hintoai.com. A machine-readable version of this policy is published at /.well-known/security.txt.

• Include the affected URL or API endpoint, steps to reproduce, and the impact you observed. Proof-of-concept requests are welcome. Please do not include other people's data.
• We acknowledge reports within two business days and give a first assessment within seven days.
• Remediation targets once confirmed are 7 days for critical, 30 days for high, and 90 days for medium severity.
• We will not pursue legal action against researchers who act in good faith, stay within the scope below, avoid privacy violations and service disruption, and give us reasonable time to fix the issue before publishing.
• In scope are hintoai.com, app.hintoai.com, published documentation sites on *.hintoai.com and customer domains, and the public API. Out of scope are denial of service, social engineering, physical attacks, and findings on third-party services we do not operate.
• We do not run a paid bug bounty. We credit researchers who ask to be credited.