How Cue handles your work.

You sign in with Google, GitHub, or a one-time code emailed to you — there is no password for us to store or for anyone to leak. Sign-in is handled through Amazon Cognito.

Your session is a signed, http-only cookie. It can't be read or forged by JavaScript in the browser, and it carries only your account identity, never your credentials.

A live key is shown to you exactly once, at the moment you create it. We store only a hash of the key, so even we can't recover the original — if you lose it, you rotate or revoke it.

Every key is scoped to your account and can be revoked instantly. Rotating a key gives the old one a short grace window so you can swap it in without downtime.

Test keys are separate from live keys and never bill. Use them freely while you build.

Card payments are handled by Stripe. Card numbers are entered directly into Stripe's fields and never touch our servers — we only ever see the last four digits and the card brand.

You can set a monthly spend cap. When you reach it, live calls stop until you raise it, so nothing can run up an unexpected bill.

Videos you upload are stored in access-controlled cloud storage and used only to analyze the clip and match music to it. They are scoped to your account and not shared with other customers.

Delete a project in the app to remove its video, or email us to request full deletion of your data.

We're a small team, and we're honest about where we stand: Cue is not yet SOC 2 certified. The practices on this page are what we do today, and formal certification is on our roadmap as we grow.

If your organization needs specific security documentation before adopting the API, get in touch and we'll work with you.

Found something that looks wrong? Email hello@vibeset.ai and we'll respond quickly. We'd much rather hear from you than not.