Security

Your projects contain work you have not published yet, and sometimes credentials you have entrusted to us. This page describes what we actually do about that — and, at the bottom, what we do not claim.

Accounts and sign-in

Authentication runs on Supabase. We never see or store your password — it is handled by the identity provider and verified there. You can turn on two-factor authentication with a TOTP app from Settings → Security. Every request to the API is re-validated server-side against your session; an expired or revoked session stops working immediately rather than at the next page load.

Who can reach your projects

Project routes check ownership on every call, not once at login. Picker Seats — the way you give a contractor access to source footage — are verified per request against the live seat record, so removing a seat cuts access immediately rather than at the end of a session. Administrative access to the internal panel is a per-user flag re-checked on every request, and the panel refuses to mount at all if its session secret is not configured.

Your own provider keys

If you connect your own AI provider keys, they are encrypted at rest with AES-256-GCM under a master key held outside the database. Plaintext never leaves the storage layer: the rest of the application receives a key only at the moment of a call. If the master key is missing or a stored value has been tampered with, the system fails closed and falls back to platform keys rather than proceeding with a broken secret.

Where your data lives

The application, database, and file storage run on infrastructure in the European Union, hosted by Hetzner. Traffic to the platform is served over HTTPS, terminated at the Cloudflare edge. The AI providers that carry out generation on your behalf are listed in full, with what reaches each one, on our subprocessors page.

Limits and abuse controls

Authentication endpoints are rate-limited to 10 requests per minute, AI operations to 30 per minute per user, and uploads to 60 per minute. Storage is bounded per plan and enforced at write time rather than reconciled after the fact, so a runaway job cannot quietly consume the disk.

Logs and error monitoring

We use Sentry for error monitoring. Request bodies on authentication and conversation endpoints are scrubbed before anything is transmitted, and our request logs record the path only — never the query string — so a token that appears in a URL cannot end up in a log file.

Dependencies

Direct dependencies on both the backend and the frontend are pinned and reviewed for known vulnerabilities, and we hold specific versions where a release has a known problem. Updates to security-relevant packages are applied deliberately, not automatically.

Deleting your data

Deleting your account removes your data in a defined order: project records and everything that cascades from them, files on disk, objects in storage, and cached state — and only then the identity record itself, so a partial failure can never leave data behind an account you can no longer sign into. Deletion completes within 30 days, as set out in our Terms.

Reporting a vulnerability

Write to [email protected] with the subject Security. Tell us what you found, how to reproduce it, and what you think the impact is. We acknowledge reports within 2 business days and will keep you updated while we fix it.

In return, we ask that you test only against your own account, do not run destructive or denial-of-service tests, do not access or modify other people's data, and give us a chance to fix the issue before disclosing it publicly. We will not pursue legal action over good-faith research that follows those limits.

What we do not claim

  • We do not hold SOC 2 or ISO 27001 certification today.
  • We do not run a paid bug bounty programme yet.
  • Our database runs on encrypted transport and access control, but we do not claim full-disk encryption of the database volume.
  • We are a small team, and we would rather tell you what is true than imply an audit we have not had.

If a procurement process needs a specific control documented, ask us at [email protected]. Related reading: Subprocessors, Privacy Policy.