--- title: "Security and privacy for self-hosted software" description: "Security and privacy in CLAQON: secrets encrypted at rest, panel password, CSRF guard, safe outbound network and encrypted backups, with their limits." url: https://claqon.com/en/security/ language: en updated: 2026-10-12 alternates: es: https://claqon.com/seguridad/ pt: https://claqon.com/pt/seguranca/ --- Security and privacy # Security and privacy: your keys and your data stay on your machine CLAQON is self-hosted software: it is installed on your machine or on a server in your name and talks directly to your providers and your platforms. Here you can see how it looks after the security and privacy of your keys, your panel and your data, what limits it has and what data CLAQON could process as a company. [Pre-register](https://claqon.com/en/pre-registration/#configurador) [See backups and updates](https://claqon.com/en/features/backups-and-updates/) - Secrets encrypted with AES-256-GCM - CSRF guard and CSP in blocking mode - Outbound network with no private addresses What it solves ## Your data and your videos, on your machine Accounts, keys, scripts, videos and logs are stored on your machine or on your server. CLAQON does not need a cloud of its own to work: it calls the AI model, the voice, the stock clips and the platforms you configure directly, with your keys. Each provider receives what it needs for its part of the work: the AI model, the text of the script; YouTube, the video. For Instagram and Facebook, the finished video goes through your Google Drive with a shared link. Each service processes it under its own terms; that is why you decide whom you connect. How it works ## How CLAQON protects your keys - **Secrets encrypted at rest**: Account credentials and key vaults are encrypted with AES-256-GCM, with a nonce of their own for each secret, and bound to their account and their field. - **Connections and OAuth apps**: These are also stored encrypted. Decrypted credentials are never sent back to the browser. - **Telegram token**: Stored encrypted; if there is no encryption key, it is not stored. - **Each webhook’s secret**: Stored encrypted and shown only once, when it is created. The caveat: the encryption key Encryption at rest depends on the engine’s encryption key. Clean installations generate it themselves; without it, secrets are stored in plain text, with a warning. Check that your installation has it. Panel access ## Who can open your panel and what it checks - **Username and password**: For logging in from outside the machine. With no password set, the panel only serves whoever is at the machine itself, with no tunnel or proxy. - **Lockout after failed attempts**: 10 wrong credentials in a row from one IP lock it out for 10 minutes. - **Password change**: From the panel itself, 12 to 128 characters, with no restart. - **CSRF guard**: Every write checks the origin of the request and that it is addressed to your installation’s name, requires a JSON body and, for sensitive actions, an operation header. - **Security headers**: A Content Security Policy (CSP) in blocking mode, a ban on embedding the panel in other pages, nosniff, Referrer-Policy, Permissions-Policy and HSTS. - **OAuth with state**: Each OAuth connection uses a state parameter bound to its platform. Capabilities ## Outbound network, containers, backups and updates - **Safe outbound network**: Downloads and calls to addresses you type yourself resolve the name, reject private addresses, pin the resolved IP, revalidate every redirect and limit size and time. It is used by your own sources, the custom model, Tinta, webhooks and trends. - **Hardened containers**: Internal services only on 127.0.0.1 and images pinned by their digest. The engine requires a token and runs without root, without extra capabilities, without privilege escalation and with memory, CPU and process limits. - **FFmpeg with no network**: FFmpeg cannot open network protocols from local files. - **An installer that verifies**: It reads the package in parts, rejects links and paths outside its folder and checks the SHA-256 of every file. - **Encrypted backups**: By default, with AES-256-GCM and a key derived from your password with scrypt. - **Signed updates Beta**: Ed25519 signature, SHA-256 per file and rollback if something fails before the point of no return. What we do not claim ## Limits worth knowing about - Not everything is encrypted: without the encryption key, secrets remain in plain text, the unencrypted backup is optional and the safety checkpoint before a restore is stored unencrypted. - We do not advertise security certifications or external audits: this page describes what the code does. - The security of the operating system, your network and physical access to the machine is up to you. - To connect most platforms you need a domain with HTTPS, usually through a tunnel. Without a password, the panel rejects whatever arrives through it. - There is a single user per installation, with no roles. Privacy ## What data CLAQON could process as a company The content of your installation – accounts, keys, videos, metrics – does not pass through CLAQON. As a company, we could only process the following data: - The data you send us through the forms on this website, such as the early access form, in accordance with the [privacy policy](https://claqon.com/en/legal/privacy/). - If your installation uses a licence, its periodic check sends the installation’s identifier and token, the version, whether it is producing, the number of accounts, the dates of the last backup and the last update, the operating system, the installation type and the profile you enter on first start-up (trading name, company and contact). Never the credentials for your services or your content. - If you need remote support with access to your installation, that access only takes place under a [data processing agreement](https://claqon.com/en/legal/data-processing/). Responsible disclosure ## How to report a vulnerability If you find a security flaw in CLAQON or on this website, write to us before making it public. The [vulnerability disclosure policy](https://claqon.com/en/legal/vulnerability-disclosure/) explains how, and this website’s security.txt file points to the same channel. Frequently asked questions ## Questions about security and privacy ### Can CLAQON see my keys or my videos? No. They stay on your machine or on your server, and CLAQON does not need a cloud of its own to work. There would only be access if you asked us for remote support, and always under a data processing agreement. ### Is everything encrypted? Not everything, and we would rather say so. Account and key secrets are encrypted at rest if the installation has its encryption key, which clean installations generate themselves. Backups are encrypted by default, except the unencrypted backup, if you choose it, and the safety checkpoint before a restore. ### What happens if someone tries to guess the panel password? After 10 wrong credentials in a row, that IP is locked out for 10 minutes. And with no password set, the panel does not serve any connection that does not come from the machine itself. ### Can I open the panel when I am away from home? Yes, by publishing it on a domain with HTTPS, for example through a tunnel, and always with a username and password. Every write also goes through the CSRF guard, which checks the origin and the installation’s name. ### Does it have security certifications? We do not advertise certifications or external audits. What this page describes is what the product’s code does, with its limits. If you find a flaw, follow the [vulnerability disclosure policy](https://claqon.com/en/legal/vulnerability-disclosure/). Early access ## Clear up your security questions before installing If your company has security or data protection requirements, tell us about them when you request access. We will tell you what CLAQON covers today and what it does not. [Pre-register](https://claqon.com/en/pre-registration/#configurador) [Talk to us](https://claqon.com/en/contact/)