Last updated: 15 October 2026
1. About this page
This page describes the measures Granwel Technologies LTD uses to look after information on valtrinity.com. It supports our Privacy policy and is the description of security measures referred to in our Data Processing Agreement. We describe what we do. We do not promise that no incident can ever happen.
2. Data in transit
- All pages and API calls are served over TLS. HTTP Strict Transport Security (HSTS) tells browsers to use TLS for the site.
- A Content Security Policy limits which scripts, images and connections a page may load.
- Upload and read links for the Video Transcriber are short lived and HTTPS only in production (see Section 5).
3. Data at rest
- Information in Microsoft Azure Storage (tables and blobs) is encrypted at rest by Azure with 256 bit AES and Microsoft managed keys.
- The Azure AI Speech service encrypts the result data it holds at rest.
- Passwords are never stored. We keep a scrypt hash, which cannot be turned back into your password.
- Counters keyed by IP address use a keyed hash, so the IP address is not stored in them.
- We hold no card data. Card details are entered with Stripe and never reach our servers.
4. Sessions and access
- Your sign in is a signed cookie (vt_session). It is httpOnly, Secure and SameSite Lax, and lasts 30 days.
- Every limit, plan check and ownership check is enforced on our servers. The browser only displays results.
- Transcripts are returned only to the signed in account that owns them.
- Stripe webhooks are checked against their signature before we act on them.
- Secrets such as keys and tokens are kept in the hosting platform's settings, not in our source code.
5. Uploads
- A browser upload link can write only one named file, for one hour. It cannot read, list or delete anything.
- The Speech service receives a read only link to that one file, valid for 25 hours.
- Uploaded media is deleted as soon as transcription finishes or fails, with a maintenance task and a storage lifecycle rule as backstops. See the Privacy policy for the full timings.
6. Protecting the service
- Tools that fetch addresses you supply go through outbound request guards that refuse requests to internal network addresses and apply time and size limits, so a request cannot be used to reach our own systems.
- Rate limits per IP address, daily caps and bot checks reduce abuse.
- Requests from Russian IP ranges are refused.
7. Logging and retention
We keep server side logs and analytics events for 90 days. They hold the route, status, outcome, device class and a keyed hash, and never the content of transcripts or file names. A stack trace on an unexpected error may include a job id.
8. Suppliers
We choose suppliers who offer data protection terms. They are listed on our subprocessors page.
9. Reporting a vulnerability
If you believe you have found a weakness in valtrinity.com, please email [email protected]. Please tell us where it is, how to reproduce it and what you think the impact is. Please:
- do not access, change or delete anyone else's information;
- do not run tests that degrade the service for other people;
- give us reasonable time to fix the issue before you tell others.
We will read your report and reply.
10. If something goes wrong
If a personal data breach occurs that is likely to put people's rights at risk, we will notify the Information Commissioner's Office within 72 hours where the law requires it, and affected people without undue delay where the law requires that. For Team, Business and Enterprise customers the timing in our Data Processing Agreement applies.
11. Contact
Security reports: [email protected]. Everything else: [email protected]. Granwel Technologies LTD, company number 17419846, Suite Ra01, 195-197 Wood Street, London, England, E17 3NU.