Security & Compliance

Your work and your clients' information are the whole business, so we treat protecting them as a core part of FrameCourier. This page describes the controls we run today, in plain terms, and where we stand on formal compliance.

Compliance status

FrameCourier has not yet completed a SOC 2 audit, and we do not claim to be SOC 2 certified or compliant. We are building our security program around the AICPA Trust Services Criteria that SOC 2 uses, starting with the Security criteria, so that an independent audit is a natural next step. We would rather tell you exactly what is in place than overstate it.

If your organization needs a security questionnaire completed (for example CAIQ or SIG Lite), we are happy to fill one in. Contact us using the details at the bottom of this page.

Access control

• Role-based permissions. Team members are Admins, Users, or Restricted. Restricted members only see the clients and projects they are explicitly granted, and cannot permanently delete anything.
• Tenant separation. Every studio's data is scoped to its own company account. Client users can only reach their own client's galleries, videos and projects.
• Passwords. Passwords are stored only as salted one-way hashes, never in plain text. Admin-invited team members must choose their own password on first sign-in.
• Two-factor authentication. Studios can require email-based two-factor codes for all team logins, all client logins, or both, and individual users can turn it on for themselves. Codes are single-use and expire after 10 minutes. Two-factor authentication is mandatory for our own system administrators.
• Sign-in protection. Repeated failed sign-ins and password-reset requests are rate limited, wrong two-factor codes lock out the pending sign-in after five attempts, and failed and throttled attempts are recorded for review.
• Session security. Sessions use secure, HTTP-only cookies and time out after a period of inactivity (and after a maximum session length), with shorter limits for administrators of the platform itself.

Protecting your content and links

• Encryption in transit. All traffic uses HTTPS, enforced with HTTP Strict Transport Security.
• Storage. Uploaded media is stored with Cloudflare R2, which encrypts stored data at rest.
• Private sharing. Gallery and video shortlinks can be password protected and set to expire, and you can see how many times each link has been viewed.
• Watermarking and download controls. You decide what clients can download and whether proofs are watermarked.
• Web hardening. We send security headers including nosniff, a strict referrer policy and clickjacking protection on signed-in pages, use CSRF tokens on forms, and use parameterized database queries.
• Payments. Card details are handled by our payment processor, Stripe. We never store full card numbers.
• Abuse prevention. Signup and contact forms are protected with bot detection and rate limiting.

Monitoring and accountability

• Activity logging. We record client views and downloads, sign-ins, and team actions on projects so studios can see who did what.
• Security event log. Failed, throttled and locked-out sign-in attempts are recorded and retained for over a year.
• Contract and release records. Signed contracts and model releases keep the signer, timestamp and IP address.

Resilience and your data

• Backups. We keep an offsite copy of uploaded media, separate from where it is served from.
• Export. Company admins can export their data (CSV files and ZIP archives of their files) at any time from Settings.
• Retention and deletion. Retention and deletion are described in our Privacy Policy. Cancelled accounts are deleted within 90 days, and you can request deletion at any time.

AI features

AI-powered features such as summaries, transcripts, tagging and Ask Milo send only the content needed for the requested operation to our AI providers. Which features process which content is documented in the Privacy Policy, and Ask Milo answers are limited to the project or documentation context it is given.

Reporting a security issue

If you believe you have found a vulnerability or a security problem with FrameCourier, please email support@framecourier.com with the details. We will acknowledge your report, investigate, and keep you informed. Please give us a reasonable chance to fix an issue before disclosing it publicly, and do not access other customers' data.

Questions

For security questionnaires or compliance questions, email support@framecourier.com. For legal and privacy matters, email legal@wedovids.com.