Security and data protection
Your studio uploads unreleased client footage. Here's exactly how we protect it.
How we protect your data
Encryption in transit and at rest
All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption.
Role-based access control
Role-based permissions, multi-factor authentication for administrative access, and regular access reviews.
Tenant data isolation
Multi-tenant architecture with row-level security (RLS) in the database, ensuring complete data isolation between studios.
Logging and monitoring
Comprehensive activity logging and security monitoring across the platform.
Automated encrypted backups
Regular encrypted backups with tested recovery procedures.
Malicious file protection
Uploads are checked against an extension and MIME-type blocklist, verified against magic-byte signatures to prevent file-type spoofing, and screened for dangerous double extensions. SVG uploads are rejected if they contain embedded scripts or external references.
Secure development practices
Security-focused development practices, code review, and regular security assessments.
Your data, your control
Cancel or close your account and, at your election, we'll return a copy of your data in a commonly used format or securely delete it, generally within 90 days. Full detail on sub-processor categories, transfer mechanisms, and data-handling terms lives in our legal documents.