Security

How Showreel Studio looks after your organisation's data, and how to tell us about a vulnerability.

Reporting a vulnerability

Write to hello@showreelstudio.app with "Security" in the subject: what you found, where, and how to reproduce it. We reply within 3 working days, keep you told while we fix it, and credit you if you would like.

While you look, please:

• test only against your own account and organisation, never another customer's data;
• don't degrade the service for others: no denial of service, spam or social engineering;
• give us a reasonable time to fix what you found before you tell anyone else.

We won't pursue anyone who acts in good faith within these limits.

The same details are in our security.txt.

How your data is protected

• Where it lives. The service runs on Google Cloud. Its database, files and backups are in London (United Kingdom), and the service itself runs in Belgium. A recovery copy is kept in the European Union, so the service can carry on if London is ever down. Who else handles personal data is on the sub-processor list.
• In transit and at rest. Every connection uses HTTPS, and browsers are told to use nothing else. Data at rest is encrypted by Google Cloud. Keys and secrets you give us, such as a Claude API key, are sealed again with AES-256-GCM before they are stored.
• Our keys. The keys that seal them are kept in Google Secret Manager, apart from the data, with a key of their own for each kind of secret. We can rotate them without losing your keys or signing anyone out, and do so at once if one is ever exposed.
• Organisations are kept apart. Every request is checked against the organisation of the person making it, in one place, so no organisation can see another's recordings, links, kits, voices or settings. On your own Google Cloud, the service acts only as your sign-in or as your organisation's own Google identity, never as a shared one, so no other organisation can use your project.
• Signing in and out. Each sign-in, in a browser or the software, is a session the service checks on every request. Signing out ends it at once, and anyone can see where they are signed in and end any of it, or sign out everywhere.
• Joining. People join an organisation by invitation, or by signing in with its email domain once an owner has proved the domain is theirs with a DNS record.
• Single sign-on. Business and Enterprise organisations can sign their people in with their own identity provider over OpenID Connect (Google Workspace, Microsoft Entra ID, Okta and others), and require it for everyone at their domain.
• An activity log. Owners and admins see who changed their organisation's people, settings, links, keys, kits, voices and audiences, and when, and can download it.
• People and roles. Owners and admins manage an organisation; members make and review. A share link is for your organisation only unless an owner or admin makes it public, and a film can be made public only if it passes the checks for an audience outside the company.
• Cloud recording. Each recording runs in its own short-lived container, under an account with no access to anything else. It reaches only addresses on the public internet, never our own network.
• Abuse. Signing in, activating a licence, the website's form, view counts and the API itself are limited per network address, and anything over the limit is refused for a while.
• Our staff. Only Showreel Studio's own staff can use the admin tools, with a second step (a code from an authenticator app) for each sign-in and a fresh one before any change. They see how organisations use the product, never their films, scripts or decks, and every change they make, and every time they look at personal data, is recorded.
• Your computer. The software runs on your machine, and your app is recorded there unless you choose cloud recording. Its local interface answers only your own computer.

Keeping it running

• Backups. The database can be restored to any minute of the last 7 days, and is also backed up daily. Deleted files can be restored for 7 days.
• Monitoring. We are alerted when the service or the site is down, when the service logs an error, and when a payment fails.
• Changes. Every change is tested automatically before it can be deployed, and each deployment is recorded.

If something goes wrong

If personal data is ever breached, we tell the affected customers without undue delay, and the Italian data protection authority (the Garante) within 72 hours where the law requires. Customers decide what to tell the people in their own material, and we help them do it.

Documents

• Terms of service, including our duties as your processor (section 13)
• Privacy notice
• Sub-processors
• A data processing agreement to sign, on request: hello@showreelstudio.app

Last updated 20 October 2026.