← Back to app

Security & privacy

Last updated: May 4, 2026 · Effective: May 4, 2026

Core commitment

Your music never trains an AI.

Not ours. Not anyone else's. We do not, and will not, train, fine-tune, embed, or test machine-learning models on user audio. We don't license your catalog to data brokers. The narrow server-side processing we do run (BPM and key detection at upload, waveform peaks, stem separation when you click it, forensic watermarking on shares) is described below in plain English. The files you upload exist in our system to do exactly what you put them there to do: stay safe, get shared, and play back.

On this page
Our top-line commitments What we technically do What we process server-side What we technically do not do Where your data physically lives Who can access your files Watermarked shares & leak provenance Breach notification Your data is yours Responsible disclosure
1. Your music never trains an AI. Not ours, not licensed, not "anonymized," not ever. This is in our Privacy Policy as a binding commitment, and it's the line we will never cross.
2. We don't listen. No human at Capiscana plays your audio for fun, curiosity, "QA," or analysis. The only audio access is what you initiate (upload, playback, share) and what your authorized share recipients trigger.
3. We don't sell or share your data. Not with marketers. Not with model trainers. Not with anyone except infrastructure providers strictly required to deliver the service (and they're contractually bound to the same posture, see Privacy §3).
4. If we receive a subpoena, we'll tell you. Unless we're legally gagged, we'll notify the affected user before complying with any law-enforcement data request, so you have a chance to push back.
5. We will notify you within 72 hours of any confirmed breach affecting your account, regardless of whether the breach was at Capiscana or at a third-party provider.
6. You can take your data and leave. Full export at /api/account/export. Permanent deletion at /api/account/delete (30-day grace, then purge). No "win-back" calls, no data hostage.

Tenant isolation

Every storage operation is bound to your account. Cross-user reads, writes, and listings fail at the adapter boundary, verified by 71 adversarial tests including path-traversal, ID-swap, and presigned-URL-replay attacks.

Encryption in transit

TLS 1.3 from your browser to our edge to our origin. HSTS enforced. Cloudflare-terminated, modern-cipher-suite. No plaintext anywhere on the wire.

Encryption at rest

Audio files are stored in Backblaze B2 with server-side encryption (SSE-S3) by default. Database backups are encrypted before they leave our servers.

Password security

Passwords are hashed with bcrypt (cost 12), never stored in plaintext, never logged. Sessions are server-side and revocable. Optional TOTP 2FA available in account settings.

Data minimization

Email, password hash, display name, the catalog metadata you provide. IP and user-agent for security/fraud only, hashed daily, not retained indefinitely. No third-party trackers (no Google Analytics, no Facebook pixel, no behavior fingerprinting).

Audit log

Every storage operation (upload, download, share-create, delete) is logged with user_id, action, key, IP, and timestamp. Tamper-evident. Supports post-incident investigation and (future) per-user "who accessed what" UI surface.

To make your library searchable and your shares accountable, our servers run a narrow set of audio analyses. None of these train any model, leave our infrastructure, or are shared with third parties:

That is the complete list. Anything else we might want to do later requires an actual product change, an updated Privacy Policy, and your continued use of the Service after that change.

We're transparent about our infrastructure. Their incident pages are our incident pages.

Two vendors, two geographic regions, multiple snapshot tiers. A single-vendor failure does not mean data loss.

That's the entire list. We do not "review" your account for QA. We do not show your files to investors, advisors, or new hires for demos. The only automated processing on the audio bytes themselves is the narrow server-side pipeline listed under What we process server-side (BPM, key, waveform peaks, on-demand stems, forensic watermarks on shares).

When you share an audio file, recipients receive a per-recipient watermark embedded in the audio stream. The watermark is inaudible to listeners but identifiable forensically. If a song you shared leaks publicly, we can trace the leak back to the specific recipient who received that copy.

This is one of the reasons Session™ Vault exists: making file-sharing accountable. Other services let your unreleased songs leak with no trace. We make leaks traceable.

If we confirm a security incident affecting your account, we will notify you via the email on file within 72 hours of confirmation. The notice will include:

This applies to incidents at Capiscana and incidents at our infrastructure providers (Backblaze, Hetzner, Cloudflare) where the provider's notification reaches us.

You can take your full catalog and walk away anytime:

If you find a security issue (vulnerability, data leak, broken access control, anything), please report it.

Email [email protected]. We aim to respond within 48 hours and to remediate confirmed issues within 30 days. We don't have a paid bug bounty yet, but we will publicly thank researchers (with their consent) once we've shipped a fix.

Please do not: attempt to access user data that isn't your own; degrade service for other users; demand payment for the disclosure; publish the issue before we've had a reasonable chance to fix it. We commit not to pursue legal action against good-faith researchers who follow these guidelines.

This page is the operational summary. The legally-binding versions of these commitments live in our Terms of Service and Privacy Policy. Where this page conflicts with those documents, those documents control.

Reviewed and updated 2026-05-04. Capiscana, Inc., 2222 Chestnut Ave STE 201, Glenview IL 60026.