shortube.pro Security: How We Protect Your Account and Content

Trust is foundational to using any platform that handles your video content and YouTube channel access. Here's a transparent overview of how shortube.pro is secured.

Authentication

shortube.pro uses Clerk for authentication — an enterprise-grade authentication provider used by thousands of SaaS companies. Your password (if you use email/password) is hashed with bcrypt and never stored in plain text. We also support Google Sign-In and GitHub Sign-In for passwordless authentication.

Sessions are managed with short-lived JWT tokens. Sign-in sessions expire after inactivity.

YouTube OAuth security

• When you connect a YouTube channel:
• You authenticate directly with Google — shortube.pro never sees your Google password
• Google issues an OAuth token scoped to the specific permissions you granted
• We store this token encrypted using AES-256 before writing it to the database
• The token is only decrypted at the moment it's needed (for an upload or schedule action)

You can revoke access at any time from our platform or from your Google account.

Video storage

• Processed videos and Shorts are stored in Cloudflare R2 with:
• Encryption at rest (AES-256)
• Private bucket configuration — files are not publicly accessible via guessable URLs
• Access via time-limited signed URLs that expire after a short window

Database security

• Our PostgreSQL database runs on Neon (serverless Postgres) with:
• TLS encryption for all connections
• IP allowlisting to restrict database access to our API servers only
• Automated daily backups

What we don't store

• We don't store:
• Your Google password (never transmitted to us)
• Your credit/debit card details (handled entirely by Cashfree)
• UPI credentials (handled entirely by Cashfree)