Security

Agencies trust us with their clients' projects, footage and contracts. This page says plainly where that data lives, who can reach it and how it is protected. It describes what is in place today. Where something is still being built, we say so.

1. Where your data lives

• Database and files: Frankfurt, Germany. Your workspace's data — projects, deliverables, clients, chat, time entries and the files you upload — is stored with Supabase, on Amazon Web Services in the eu-central-1 region in Frankfurt. The backups are kept there too.
• Server functions. Our server-side functions run on Supabase's network, in the location closest to the request, and read and write the database in Frankfurt. They don't keep a copy of your data.
• The web app. Vercel serves the app's code (the pages and scripts your browser loads) from its global network. Your workspace data isn't stored at Vercel. Requests from the Claude connector pass through Vercel's network on their way to the database, and nothing is kept there.
• Other providers. Some features need another provider, such as payments (Stripe), email delivery, AI features, transcription and error monitoring. Each one, with what it does and where it processes data, is listed on our sub-processors page.
• Tools you connect. If you connect Frame.io, Dropbox, Google or another integration, the data you send there is stored by that service under your own account with them.

2. Who can access it

Your team

Every member of a workspace has one of four roles (admin, manager, member, limited), and admins can narrow further which sections a member sees. These rules are enforced in the database itself, not only in the app, through PostgreSQL row-level security. On 22 October 2026, row-level security was switched on for all 210 tables in our application database. An automated test fails the build if a new table without it appears.

People you share with

Your clients see what you put in their portal or share link. Someone from another workspace sees a project only when you share that project with them by name, and you can take that back at any time.

Our staff

• Three people at contentmaker.space have staff accounts in the app. Each one signs in with two-step verification.
• Direct access to the production database and the hosting accounts is limited to one person, our founder.
• We open your workspace only when you ask us to, for example for support, or to deal with an incident.
• Every time a staff member opens a workspace as its admin, it is written to an append-only access log that nobody can change or delete, including us: who it was, when, which workspace, and the reason if they gave one. Your admins can ask us for this log today; a view of it in workspace Settings is planned.
• Staff accounts also have back-office rights for billing and support. Logging each of those reads individually, and narrowing those rights, is work in progress.

3. How it's protected

• Encrypted in transit. The app, the API and file downloads are served only over HTTPS (TLS 1.2 or 1.3), and our domains tell browsers never to connect without encryption (HSTS).
• Encrypted at rest. Supabase encrypts the database, its backups and stored files with AES-256. This is done by our hosting provider, not by contentmaker.space itself.
• Sign-in. You sign in with a password (stored only as a salted hash), an email link, or Google. Anyone can turn on two-step verification with an authenticator app under Settings → Login & security. Once it is on, the database refuses requests for your workspace data from a session that hasn't entered the code, so a stolen password alone doesn't get anyone in. Signup is protected against bots.
• Private files. Project files are kept in private storage and open only through short-lived signed links, after we have checked that you are allowed to see them. That covers documents, deliverable videos, scripts, chat attachments, storyboards, production audio and photos, and call recordings.
• Images meant to be shown. Profile photos, company logos, portfolio media, cover images, and images placed in knowledge-base articles and moodboards are kept in public storage. Anyone who has the exact link to one of these images can open it.
• Backups.Supabase backs up the database automatically every day and keeps the last 7 days. A restore goes back to the most recent daily backup, so in the worst case up to one day of changes could be lost. Uploaded files are not part of these backups: they are stored once, in Supabase's file storage, and we keep no second copy of them yet.
• Browser protections. The app sends security headers that stop other sites from framing it (public forms and help articles excepted, because they are made to be embedded) and stop browsers from guessing file types.
• How we build. Every change to the code and the database goes through a pull request and automated checks, including database security tests that come from an internal adversarial security review in July 2026. Errors are reported to our error monitoring, which stores data in the EU.
• Deletion. Items you move to the trash are deleted for good after 30 days, and activity logs after 90 days. When a person asks for their account to be erased, we anonymise it straight away and delete what remains within 30 days.

4. Our providers' certifications

These are the certifications of the companies we build on, not ours. contentmaker.space itself is not ISO 27001 certified and has no SOC 2 report. These certifications cover our providers' data centres, platforms and processes. They don't cover our own code or the way we run it, which is what the rest of this page describes.

Each provider publishes its own reports and certificates, usually under a non-disclosure agreement, through the links above. We checked this list against their pages on 22 October 2026.

5. If something goes wrong

If a security incident affects your workspace's data, we tell you within 48 hours of becoming aware of it: what happened, what data is involved, and what we are doing about it. That commitment is part of our Data Processing Agreement.

To reach us about a security question or a suspected incident, write to contact@contentmaker.space.

6. Reporting a vulnerability

If you think you've found a security problem in contentmaker.space, please email contact@contentmaker.space with what you found and how to reproduce it. We reply within three working days and keep you posted until it's fixed.

Please test only with accounts and workspaces you own, don't access, change or delete other people's data, don't disrupt the service, and give us reasonable time to fix the problem before you tell anyone else. If you act in good faith within these limits, we won't take legal action against you. We don't run a paid bug bounty. Our contact details are also published in security.txt.

7. The legal side

• Data Processing Agreement, including the technical and organisational measures in its Schedule 3
• Sub-processors: every provider that handles your data, and where
• Privacy Policy
• Terms & Conditions

Need a security questionnaire filled in for your procurement or IT team? Ask us at contact@contentmaker.space. We have a standard answer set ready.