Security Policy

Effective date: 18 October 2026

How we protect your data

• Encryption in transit. All connections to Bespoke use HTTPS (TLS).
• Passwords. Passwords are stored only as salted scrypt hashes – nobody at The Wictory can read them.
• Account isolation. Each customer's projects, uploads and videos are kept separate and are available only to that account.
• Payments. Card, UPI and bank details are handled by our RBI-authorised payment gateway partner, which is PCI-DSS compliant, and never reach our servers.
• Infrastructure. The Service runs on Amazon Web Services in the Mumbai (India) region. Server access is limited to authorised personnel using key-based authentication.
• Mobile verification. One-time passwords are handled by Google Firebase.
• Least data. We collect only what we need and delete files on a fixed schedule (see our Data Retention Policy).

Incidents

If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities as required by law, and take steps to contain it.

Your part

Use a strong, unique password, keep your email account secure, and sign out on shared devices.

Reporting a vulnerability

If you find a security issue, email support@thewictory.net with the subject "Security report" and the details needed to reproduce it. Please give us reasonable time to fix it before disclosing it publicly, and do not access other users' data, disrupt the Service or run automated attacks. We will not take action against good-faith research that follows these rules.