// Trust & Security Report
NOCAP, Inc.
Captions (AI video editing and creation platform) with sub-products including AI Edit, avatar generation, automatic captions, translation and dubbing into 30+ languages, and AI-based video enhancement tools.
Certifications held
2
Maturity
Growth
Trains on your data
Yes
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on mirage.app“Mirage is SOC 2 compliant, meaning our security and operational controls have been independently audited and meet industry standards for protecting customer data.”
Verify on mirage.app“Standard Contractual Clauses pursuant to Article 46 of the GDPR: the European Commission has adopted Standard Contractual Clauses, which provide safeguards for personal data transferred outside of the EEA. Adequacy Decisions pursuant to Article 45 of the GDPR: we may transfer personal data about you to countries that the European Commission has deemed to adequately safeguard personal data.”
> Show 5 unconfirmed / not-held certifications
source: mirage.appNo public evidence found on vendor domain. ISO 27001 not mentioned in privacy policy, terms, or safety & security pages.
source: captions.aiCaptions prohibits uploading content containing protected health information as defined by HIPAA, except as permitted by an executed HIPAA BAA. The vendor acknowledges HIPAA BAA capability but does not claim HIPAA certification.
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Offered
Data region
US-based Google Cloud data centers (isolated and encrypted)
Privacy policy states collected information is used to 'Develop, operate, improve, maintain, protect and provide the features and functionality of the Services, including to train our artificial intelligence/machine learning models.' The Captions terms grant Mirage a 'limited, nonexclusive, royalty-free, sublicensable license in your Input and Output' to host, cache, store, reproduce, modify, distribute and use content to provide, improve, and develop new services and products. No affirmative opt-in consent gate or opt-out mechanism for model training is described in the public documentation; agreement is via acceptance of the Terms.
// Security controls
Personnel Security
Background checks, confidentiality agreements, and mandatory security education
mirage.app// Products & data scope
data: Video files, user-generated content, usage data
Primary product: AI-powered video editor with automatic caption generation, translation to 30+ languages, scene cutting, B-roll overlay, and style-based editing. Supports browser-based editing.
data: Video files, user-generated content, usage data
Desktop and mobile application for Captions. Same feature set as web editor with platform-specific optimizations.
data: User selfies, avatar templates, generated video content
Generates talking videos from selfies or creates AI actors. Supports outfit/background/product placement changes and reuse across multiple videos.
data: Raw video footage
Applies pre-trained editing styles to raw footage (e.g., Elevate, Paper, Prime). Multiple styles available; applied with single click.
// What to watch
- Third-party security aggregator (Nudge Security) lists extensive certifications (PCI, HIPAA, ISO 27001, FedRamp, CSA STAR Level 1) that are NOT corroborated by vendor's own published pages. This may indicate: (a) outdated aggregator data, (b) vendor does not publish full cert details publicly, or (c) aggregator error. Recommend direct vendor contact to verify.
- Privacy policy states collected information is used to train Mirage's AI/ML models; no affirmative consent gate or opt-out mechanism for training is described in the available documentation.
- HIPAA BAA referenced as available but not standard; organizations handling PHI must execute BAA before use.
- Legal structure: NOCAP Inc d/b/a Captions with legal pages hosted at mirage.app (parent company or rebranding scenario). Verify ongoing product stability under any rebranding.
- SOC 2 certification dated March 5, 2026 (recent) but audit scope (Type 1 vs Type 2) and renewal cycle not specified in public materials.
// At a glance
Pricing model
Freemium subscription (free tier available, premium plans for advanced features)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on NOCAP, Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
mirage.app