A video editor holds the thing you are most careful with: the rushes, before anyone has approved them. This page says, in order, what stays on your disk, what leaves and when, how your account is protected, and what the installers are signed with. Nothing below is a promise we cannot point at.
The rule is simple to state: nothing leaves the machine unless you asked for something that can only happen elsewhere. Below is the whole list, on both sides.
Nothing you upload or generate is used to train anything. Media sent for a job is held under your own workspace for the job and its result; a cloud project stays until you delete it. The mechanism behind "the editor never learns where your files are" is on the local-first page.
CNEX Cut signs in to the same account as the rest of CNEX Flow, so the protections are the platform's, not a lighter copy made for an editor.
An authenticator app, SMS or email — a sign-in that returns a challenge is not a sign-in until you answer it.
The access token lives in memory and is re-minted when the app starts. The refresh token rotates on every use, and a replayed one is treated as theft: the whole family is revoked.
Sign-in, sign-up and password reset are protected by reCAPTCHA where the server enforces it. Failed sign-ins lock the account; a new device is announced.
An account can belong to several workspaces; media, projects and credits live inside one. Roles and permissions decide who sees what — and the same applies to any AI staff you hire.
Every call to the platform is over TLS. Credentials the platform holds on your behalf sit in an AES-256-GCM vault, never in code or config.
When you connect your own assistant, it talks to the editor through a fixed set of tools — add a title, trim a clip, generate captions, export. Every tool is addressed by clip id and answers with the state of the composition. There is no tool that takes a path, lists a folder or reads a file, so the assistant can only ever act on media you already put on the timeline.
Every tool call is one undo step, and the actions that reach outside the editor are guarded in the tool itself: publishing to a social account will not run without you naming the account and approving the exact title and description, and anything that spends credits is quoted first. The assistant is yours — your subscription, your keys — and we never see the conversation.
Built for Apple silicon and Intel. Signed with a Developer ID certificate and notarised by Apple before release; the hardened runtime is on, with entitlements only for the camera, the microphone and outbound network.
An NSIS installer for 64-bit Windows. The app uses the same signed update feed as macOS.
The .deb is the one to install — it works on Ubuntu 24.04 and later where an AppImage trips over the sandbox helper. Updates follow the same feed.
The release pipeline refuses to publish a macOS build that is unsigned or un-notarised — a build Gatekeeper would reject on your machine never reaches the download page. Updates arrive through the app's own updater from the same signed feed.
Found something this page does not answer, or something it gets wrong? Tell us — it gets fixed here, not in a footnote.