Security & Trust

Code-signing identities

Current ClipSalvage downloads retain their Qloud LTD code signatures; the operator and licensor is QLOUD L.P. Your operating system checks this automatically, but you can verify it yourself:

macOS

ClipSalvage is signed with an Apple Developer ID and notarized by Apple (macOS scans it and staples the notarization ticket to the app before you ever run it). To check the signer yourself:

codesign -dv --verbose=4 /Applications/ClipSalvage.app

You should see:

• Authority: Developer ID Application: Qloud LTD (RK93245G56)
• Team Identifier: RK93245G56
• Notarization Ticket: stapled

Windows

ClipSalvage's Windows installers are signed with a code-signing certificate issued to QLOUD L.P. Right-click the downloaded .exe → Properties → Digital Signatures to check it yourself. You should see:

• Signer: Qloud LTD, Charing, Kent, GB
• Issued by: Certum Code Signing 2021 CA (Asseco Data Systems S.A.)
• Timestamped at the time of signing, so the signature remains valid after the certificate itself expires

Verify a download's checksum

SHA-256 checksums for the current release (v2.43.1). Compute the hash of your downloaded file and compare it against the value below — they should match exactly. Each installer is also on VirusTotal: the linked report is keyed to that exact hash, so it shows the current multi-engine verdict for the file you downloaded, not a verdict about the website.

All three installers for this release show no detections on VirusTotal (0 malicious, 0 suspicious). We link the reports rather than summarise them so you can see the current verdict for yourself.

To compute a hash yourself: shasum -a 256 <file> on macOS, or Get-FileHash <file> -Algorithm SHA256 in PowerShell on Windows.

How ClipSalvage handles your data

ClipSalvage processes everything locally. No video data, thumbnails, or disk contents are ever uploaded to a server:

• Drive scanning and file carving run entirely on your computer
• The on-device camera-angle AI model runs locally too — no image or video data leaves your machine to identify a camera angle
• Recovered clips are written only to the destination folder you choose
• Network activity includes license activation and verification, update checks, Tesla sign-in and requests for missing clip keys, and usage reporting when you consent. Footage, thumbnails and disk contents are not uploaded.

Full detail: Privacy Policy.

What the Tesla sign-in does and does not grant

Tesla sign-in retrieves missing keys for your selected clips. The following explains the permissions involved.

• We never see your password. The login window is Tesla's own, on Tesla's domain. Your email and password go straight to Tesla; ClipSalvage receives only the resulting access token — the same one Tesla's own dashcam viewer runs on, so Tesla issues us nothing broader.
• The token cannot touch your car. It is issued to Tesla's dashcam sign-in client and carries identity permissions only. It does not include vehicle_device_data or vehicle_cmds — the permissions Tesla's Fleet API requires to read from or send commands to a car — so it cannot unlock, drive, locate or otherwise control your vehicle.
• It is spent on a single request: asking Tesla to unseal the keys for the clips you selected.
• It is short-lived and stored by your OS. It expires on its own in about eight hours and is kept in your operating system's credential vault (macOS Keychain / Windows Credential Manager), encrypted by your OS — never in a plain file, never in a log. Signing out deletes it from your machine.
• You do not have to take our word for it. Run any network monitor while you recover a clip and you will see your Tesla token go to one place — Tesla's own dashcam endpoint — and nowhere else.

If you would like to verify any of this before trusting the app with a sign-in, email support@clipsalvage.com and we will walk you through exactly what to check. Clips your car saved unencrypted are ordinary MP4s and never need a sign-in at all.

Company registration

Full company profile, other products, and entity references: QLOUD L.P..

Reporting a security issue

If you believe you've found a security vulnerability in ClipSalvage, email support@clipsalvage.com with details. We'll acknowledge genuine reports and work with you on a fix before any public disclosure.