Security & Data Protection

Each workspace operates in complete isolation. We use Row Level Security (RLS) at the database level, meaning access policies are enforced directly in the data layer, not just in the application code.

This guarantees that one tenant's data can never be accessed by another tenant, even if an application-level vulnerability were to exist. Every database query is automatically filtered by tenant identifier.

• Encryption in transit: all traffic between your browser and our servers is encrypted with TLS 1.3 (HTTPS). No data is transmitted in plaintext.
• Encryption at rest: the database and file storage use AES-256 encryption at rest. Your screenplays and documents are protected even at the disk level.
• Hosting: the platform is hosted on Supabase infrastructure (AWS) with data centers in the United States. Supabase holds SOC 2 Type II certification for its services — verifiable on their trust center.
• Global CDN: static assets are served through Vercel Edge Network with built-in DDoS protection.

• Dynamic watermarks: Data Rooms generate PDFs with per-invitee watermarks, allowing you to trace the source of any leak.
• Mandatory digital NDA for readers: readers invited to evaluate your production company's scripts must electronically sign a Non-Disclosure Agreement before gaining access to the material. The signature is logged with full name, IP, timestamp, and persisted in the reader's record inside your workspace. The NDA uses the legal data your production company configures (legal entity name, registered address).
• Operator-controlled expiration: when you create a Data Room (or when you invite a specific person) you can set an automatic expiration date — the link stops working at that point. You can also revoke access for specific invitees or disable the entire Data Room at any time. Default expiration is open-ended; enabling it is at the workspace owner's discretion.
• Private storage: files are stored in private Supabase Storage buckets. They are not accessible via public URL without authentication.
• Per-invitee unique token access: each Data Room invitee receives a link with a unique opaque token. Visits, downloads and opens are logged so the room owner knows who saw what.

• Granular roles: each user has an assigned role (Director, Executive, EP, Reader) with specific permissions that determine what they can see and do.
• Configurable permissions: tenant administrators can customize which actions each role is allowed to perform.
• Secure authentication: we support email/password login (with bcrypt hashing) and Google OAuth. Sessions use JWT with automatic expiration.
• Optional multi-factor authentication (MFA): each user can enable MFA with an authenticator app (TOTP) from their profile. The workspace operator can require MFA for specific roles.
• Hashed recovery codes: MFA recovery codes are stored as sha256 hashes, never as plaintext.
• Custom domains: each tenant operates on its own subdomain (company.slatecore.app), completely isolating sessions.

• Activity log: every relevant action is recorded — who accessed what, what was modified, when, and from where.
• Version history: breakdowns and shooting schedules maintain version history with the ability to restore previous versions.
• Email log: all emails sent from the platform (invitations, notifications) are logged with date, recipient, and delivery status.

• Two-tier automatic backups: the database is backed up daily with 30-day retention, plus weekly backups retained for up to 12 weeks. All backups are stored encrypted in infrastructure separate from the main runtime (Cloudflare R2).
• Disaster recovery: in case of failure, data can be restored from the most recent backup. Target recovery time depends on the scope of the incident.
• Availability as an operational target: the infrastructure is designed with redundancy and we aim for high availability under normal operation. This is an operational target, not a contractual SLA with a guaranteed percentage — the Terms of Service detail the scope of warranties.

The Service's AI features (script analysis, breakdowns, chats, suggestions) run only when you request them, using Anthropic Claude models.

• Anthropic does NOT use your content to train its models. Guaranteed by their commercial policy in force for API customers (Anthropic Commercial Terms).
• Submitted content is processed transiently to generate the response and is deleted in accordance with the provider's retention policy.
• The provider does not share your content with other Anthropic customers.
• The SlateCore team does not browse the inputs or outputs of your AI calls.

The Service relies on specialized providers, each with limited scope and under their own privacy and security policies:

• Supabase — database, authentication, file storage.
• Vercel — application hosting + edge CDN.
• Cloudflare — backup storage (R2), DNS.
• Stripe — payment processing (PCI-DSS).
• Anthropic — AI models when requested.
• Resend — transactional email delivery.
• Google — sign-in OAuth + calendar sync.
• Sentry — technical error diagnostics (no content data).

The full list, purpose and country of operation for each subprocessor is in the Privacy Policy §7. We notify any addition or material change with at least 15 days advance notice to active accounts.

The SlateCore team does not access any tenant's data unless strictly necessary to:

• Resolve a technical issue reported directly by the client.
• Comply with a legal obligation or court order.

Any administrative access is recorded in the internal audit log. There is no casual or exploratory access to client data.