Security and data handling

Video, images, documents and voice comments go from your browser straight to storage through short-lived signed links. Shotread's server never reads the file contents, and Shotread never downloads videos from platforms.

Uploaded originals are checked with a SHA-256 checksum, so a damaged copy is noticed.

Sign-in runs on Auth0 (Okta); Shotread never sees your password. Inside a workspace, each person has a role (owner, admin, account manager, strategist, editor, community manager, analyst or client), and every action checks it on the server. A member limited to some clients never sees the others, and clients see only what is shared with them.

Access tokens for the accounts you connect (for example a YouTube channel) are encrypted with AES-256-GCM, with a key kept outside the database and outside the website's files. Settings that hold secrets are stored encrypted too. Disconnecting an account deletes its tokens.

Changes in a workspace are written to an audit log. Its entries are chained with keyed hashes, so a changed or missing entry shows when the log is checked. Audit entries are kept for at least 365 days.

Messages that providers send to Shotread (webhooks) are checked with the provider's signature where the provider offers one; a message that cannot be checked only makes Shotread ask the provider again. A signed message that arrives twice is ignored.

Plan payments run on Stripe. Card details are entered on Stripe's own page and never reach Shotread. Shotread never holds or moves money between agencies, clients or creators, and never stores tax ids or bank details.

A workspace owner can find, export and erase one person's data (for example a creator, a guest reviewer or a lead) across the workspace, set how long some kinds of records are kept, and see the list of services that process the workspace's data. When an owner deletes a workspace, it is removed 14 days later: stored files first, then the records.

Shotread runs on Amazon Web Services, with its own database, sign-in application, storage bucket and mail sender. The database is backed up every day. The services that process data for Shotread are listed in the privacy policy.

If you think you have found a security problem, email howdy@shotread.com with the word Security in the subject. Please give us time to fix it before you tell anyone else. Our contact details are also in security.txt.

Shotread does not hold a security certification such as SOC 2 or ISO 27001 yet.