Security
Your show does not leave your building
The hardest security problem in post is unreleased picture travelling. This product reads your storage and reports on it. It never copies your media anywhere, which removes most of the argument before it starts.
This page is written for whoever has to approve a vendor, not for the person who liked the demo. Every line says whether it is true today or not, using the same three states as the integrations page, and the thingsBaton does not do are named along with who does them properly.
A claim you can catch us on is worth less than no claim, because it puts everything else here in doubt.
Your media does not move
The biggest risk in post is unreleased picture travelling. This system reads your storage and reports on what it finds there. It never copies your media anywhere.
Files stay where they are
Working todayThe agent runs on a machine at your facility and reports what it finds on the volumes you point it at. Nothing is uploaded, and there is no bucket on our side holding a copy of your show.
Enforced byThe on-premises agent, which has a fixed verb list and no upload path
It reads as you, not as itself
Working todayThe agent uses the permissions of the account it runs as, and follows no shortcut out of a folder it was given. It has no key of its own to anything.
Enforced byFilesystem permissions; symlinks out of a declared root are refused
A request can say what, never where
Working todayA search names a file. It cannot name a path. Anything that looks like one, including a bare folder or a parent reference, is refused rather than treated as a filename. There is no option that takes a location.
Enforced byRoots come from a setting on the facility machine, read fresh each run
It cannot be used to map your storage
Working todayHow many results come back is capped. So is how deep it goes, and how long it is allowed to run. A request cannot raise any of them. A query of one or two characters is refused, because against a shared volume that is a walk through everything rather than a search.
Credentials stay with the person
The system plans work and your browser does it. There is no copy of anybody’s login sitting on a server waiting to expire or leak.
The push runs in the editor’s own session
Working todayMarkers go onto the sequence from the editor’s browser, on the production-management session they are already signed into. The server works out what to write and never holds a credential for somebody else’s account.
Enforced bypushMarkersFromBrowser, with every push route going through a permission check
What crosses the wire is a location, not a token
Working todayThe server answers with where the sequence is, so the browser knows where to go. No cookie and no token appears in any response.
Actions are recorded as who did them
Working todayProduction management stamps every marker with whoever is authenticated. Pushing on somebody else’s behalf produces your markers in their bin, not theirs, and the refusal says so.
Single sign-on
Built on requestSAML and OIDC, so people sign in with the identity provider your facility already runs and access is removed when someone is offboarded there. Not written yet. It is the first thing we will build for a customer whose security review asks for it.
Unaired material is treated as unaired
Before air, a clip is the product. The rules about it are functions in the code, not instructions in a prompt.
No clips out of an unaired master
Working todayA clip can be cut from something that has aired. From an unaired episode the answer is no, unless somebody with the authority has lifted the embargo for that specific episode, with a reason and an end date.
Enforced bycanCutClip, called before the assistant is asked to cut anything
The assistant cannot be talked round
Working todayThis is a function, not a policy written into a prompt. A language model can be argued out of an instruction by a good story, by urgency, or by somebody claiming to be the executive producer. It cannot be argued out of a function that returns a refusal.
A waiver is narrow and it expires
Working todayOne episode, a stated reason, an end date. A standing waiver is the same as having no rule, because it gets granted once in a hurry and forgotten. You cannot lift it for yourself, and the refusal names the roles that can.
Confidential themes are withheld before they are sent
Working todayA show can declare that its episode themes carry unannounced names. They are replaced on the server, so the real text is never sent, never cached, and never sitting in a browser network tab. The screen says it was withheld on purpose rather than leaving a blank that looks like missing data.
Enforced byredactedTheme, applied server-side before the response leaves
What leaves the building, and what does not
Support and diagnostics are where production detail usually escapes, because somebody pastes an error into a thread. That path is closed deliberately.
The support check-in prints no names
Working todayThe machine at your facility runs one command and pastes the result to us. It carries counts, shapes and yes-or-no answers. Never a show, a person, an episode number, a path or a theme. A show is "show 1".
Enforced byEnforced by the server rather than trusted to the script, with a test that fails if an identifier gets in
On-screen messages and support output are different things
Working todayThe message on screen names the show, the step and the role, because somebody has to go and fix it. The version you send us carries a code instead. Same fault, different readers.
We can read your spreadsheet without reading your spreadsheet
Working todayWorking out what your master grid does normally starts with emailing us the file. Instead, one command reports its shape. How big it is, which row is really the header, how full each column is, and what each column is therefore for. It never reports a single cell. Column headings are opt-in, and the report carries the warning at the top.
Enquiries do not pass through a third party
Working todayThe contact form on this site sends mail through our own domain routing rather than a marketing platform. No outside service holds the contents, and there is no CRM sequence behind it.
How we build it
Practices matter more than promises here, because the practice is what is still true on a bad Friday.
Production detail cannot be committed
Working todayAutomated gates refuse to publish anything containing a production identifier: a person, a show title, an episode numbering scheme, a facility host, a vendor. Without a list to check against they fail closed rather than reporting clean.
Enforced byTwo gates reading one list, tested against a deliberately poisoned tree
The demo is synthetic, entirely
Working todayEvery screen on this site and every record in the live demo is invented. It is scanned on every build for anything production-shaped, and the build fails rather than shipping it.
Independent penetration test
Built on requestA third-party test against a customer deployment, with the report shared. Not done. We will arrange one where a security review asks for it, and we would rather do that than describe ourselves as tested.
SOC 2 Type II
Built on requestNot held. It is a real programme with a real cost and we have not run it. What we can do today is answer a security questionnaire in writing, name where each control is enforced in the code, and give your team a call with the person who wrote it.
Answers for a content security assessment
Studio and network risk management assess a vendor before unreleased material goes near it, usually against the MPA content security best practices through TPN. These are the questions that arrive on that spreadsheet, answered here so the process can start from something rather than from nothing.
Content handling
The first question on every assessment, and the one this product answers differently from most vendors.
- Will our content be stored on, or pass through, your systems?
- No. The agent runs inside your facility and reads the volumes you point it at, reporting names, sizes and dates. There is no upload path in it, and nothing on our side that could hold a frame of your show.
- Do you make copies, proxies or transcodes of our media?
- Not as part of coordination. The board tracks where things are. It does not make new copies of them. Cloud transcode and delivery is a separate product conversation with a separate answer, and it is not part of what tracks your season.
- Can your staff view our content?
- There is nothing for us to view, because we hold no media. Support diagnostics carry counts and codes with no show, person, episode number, path or theme in them, and the server enforces that rather than trusting the script to remember.
- How is unreleased material protected from the built-in assistant?
- Cutting a clip from an unaired master is refused by a function in the code, not by an instruction in a prompt, so it cannot be argued around by a plausible story or somebody claiming to be the executive producer. Lifting it needs authority, covers one episode, requires a reason, and expires.
- Do you apply forensic watermarking to screeners?We do not have this
- No, and deliberately. Audited distribution of unreleased material is a compliance business with an audit budget, not a software feature. If a cut has to leave the edit, send it through PIX, 5th Kind or Moxion. We will track that it went and when.
Access and identity
- How are credentials to connected systems handled?
- They are not held. Marker pushes run from the editor’s own browser on the session they are already signed into. The server plans the write and never stores a credential for anybody else’s account. No token and no cookie appears in any response.
- Do you enforce least privilege?
- Permissions are per role and checked on the server, not in the interface. A recall can only be issued by a post supervisor or post producer. A step can only be completed by the people it is for. A record made in somebody else’s name is refused.
- Do you support SSO, and does deprovisioning propagate?We do not have this
- Not yet. SAML and OIDC are the first thing we build for a customer whose review requires it, so that removing somebody in your identity provider removes their access here. Today access is managed per deployment.
Audit and monitoring
- Is there an audit trail of who did what?
- Yes. Handoffs, completions, recalls, revisions and approvals are recorded with who and when. A package sign-off records which version was approved, and replacing that copy clears the old signature rather than carrying it forward, because a signature is on a specific thing.
- Are automated decisions recorded, including the ones to stay silent?
- Yes. Every notification decision is written down with its reason, including the suppressions. The question people ask afterwards is why they were not told, and that only has an honest answer if the reason was recorded at the time.
Development and change control
- How do you keep production data out of development?
- Automated gates refuse to publish anything containing a production identifier: a person, a show title, an episode numbering scheme, a facility host, a vendor. With no list to check against they fail closed rather than reporting clean, and they are tested against a deliberately poisoned tree rather than trusted because they have always passed.
- What data do your demos and test fixtures contain?
- Invented data only. Every record in the public demo is synthetic, and the build scans for anything production-shaped and fails rather than shipping it.
- Do you hold SOC 2, ISO 27001 or a TPN assessment?We do not have this
- None of them today, and we would rather say so than imply otherwise. The architecture is deliberately shaped so the assessable surface stays small, because we do not hold your media. We will go through an assessment with the first customer whose process requires one.
- Has the system been penetration tested by a third party?We do not have this
- Not yet. We will arrange one against a customer deployment and share the report, rather than describing ourselves as tested.
Answered in writing, under NDA
These are covered in the questionnaire rather than published. Putting an incident response runbook or a network topology on an open page is not transparency, it is a map for somebody else. The headings are here so you can see the topic is covered and know what to expect back.
- Hosting topology and regions, plus any sub-processors
- Encryption in transit and at rest, and how keys are handled
- Incident response, and the breach notification window we commit to
- Business continuity, and recovery objectives
- Data retention, and deletion on termination with certification of it
- Background checks, confidentiality agreements and security training
- Cyber liability and errors and omissions cover
- Vulnerability management and patching cadence
- Right to audit, and what access that grants you
What we deliberately do not do
These are real problems with real vendors who are good at them. Nothing about coordination gets better by taking them on, and a product that claimed all of this would deserve to be doubted about the rest.
Sending screeners to executives
Use PIX, 5th Kind, Moxion
Forensic watermarking and audited distribution of unreleased material is a compliance business with an audit budget, not a software feature. If a cut has to reach somebody outside the edit, it should go through one of these. We can point at the delivery; we will not become it.
Payroll, timecards and residuals
Use Entertainment Partners, Cast & Crew, Wrapbook
Personal and financial data for crew, under union agreements and state rules. Nothing about coordination gets better by holding it, so we do not.
Clearances and rights
Use Rightsline, FilmTrack
Contract modelling, windowing and territories. A different product entirely.
Send us your questionnaire
Send the questionnaire your studio uses. It comes back filled in, with a named place in the code for each control, and anything we do not do marked as not done.
Start that conversationSee it on a real board
The demo is the actual software, running on a made-up show. Nothing to install, no sign-up.
Walkthroughs are with someone who spent 15 years as an assistant editor, not a sales rep. Who builds it.