Security

Last updated: October 6, 2026

How we protect you

• Every connection between the app, the website and our servers is encrypted (TLS).
• Sign-in is handled by Clerk; we never see or store your password.
• Payments are handled by our payment processor; we never see or store your card details.
• Keys for the AI services we use stay on our servers and are never shipped inside the app.
• Your history, recordings and dictation profile are stored on your Mac, not on our servers.
• Every request is checked against your account and plan on our servers, and rate-limited to stop abuse.
• The Mac app is signed with our Apple Developer ID and notarized by Apple, and updates are signed.

Reporting a vulnerability

If you think you’ve found a security problem, write to support@composer1.com with the subject “Security”. Include what you found, how to reproduce it and what it could affect. We’ll acknowledge your report within 3 business days and keep you updated while we fix it.

We ask that you:

• only test against your own account and data;
• don’t access, change or delete other people’s data, and stop as soon as you reach any;
• don’t degrade the service (no denial-of-service, spam or automated scanning at volume);
• give us reasonable time to fix the problem before telling anyone else.

If you follow these rules and act in good faith, we won’t pursue legal action against you for your research, and we’re happy to credit you once it’s fixed.