Security

Design principles

Transmute is designed so that your data stays yours. The three concrete choices that reflect this:

• Zero Data Retention mode — files are processed in-memory. No record of the payload is written to a database or durable log. Once the transformed output is returned, the source data is gone from our side.
• Bring your own AI keys — when you supply an API key, requests go directly from the server to the AI provider. We do not store keys after the request completes and we do not proxy or cache AI responses.
• Offline-capable — the TXL execution engine can run entirely on your machine. No data has to leave your network.

Transport

All traffic between your browser and Transmute servers uses HTTPS (TLS 1.2 or later). We do not serve the application over plain HTTP.

Authentication and sessions

Transmute does not require an account for basic use. Where session tokens are issued they are scoped, short-lived, and stored in HttpOnly cookies that are not accessible to JavaScript. Magic links that carry session state expire and are single-use.

Isolation

Each transformation job runs in an isolated execution context. Output from one job cannot be accessed by another session. Errors returned to the client include only the information relevant to your own job.

What we do not claim

We want to be straightforward about where we are:

• We have not undergone a SOC 2 audit at this time.
• We have not completed formal penetration testing by a third party.
• We do not hold ISO 27001 certification.

If compliance certifications are a requirement for your use case, please contact us so we can give you an accurate picture of our current posture.

Contact

General privacy questions: see our Privacy page