Security Policy Statement

Security Statement

At FilmTailor AI we protect your scripts, media and production data with encryption, access controls and secure engineering practices. Unreleased scripts and crew details are sensitive, and we treat them that way. This statement describes the measures we use. We may improve them over time, and will not materially reduce the overall level of protection.

1. Encryption at rest

Data stored on FilmTailor AI, including account information and media assets, is encrypted at rest using the built-in encryption of our cloud database and file storage (AES-256), so that files you upload or that the Service generates stay protected if a storage system is compromised.

2. Encryption in transit

We redirect web traffic to HTTPS and use HSTS on our main services, so data sent between you and the Service is protected from interception and tampering.

3. Authentication and passwords

Passwords are never stored in plain text. They are hashed with bcrypt, which adds a unique salt and deliberate computational cost to resist brute-force and guessing attacks.

4. Secrets management

Application credentials such as API keys, access tokens and database connection strings are kept in an encrypted, access-controlled store. Only authorised services and personnel can retrieve them, which reduces the risk of accidental exposure or misuse.

5. Non-guessable identifiers

Users, projects, files and documents are identified by globally unique identifiers (GUIDs) rather than sequential numbers. Links for sharing call sheets use a random token. This makes it much harder for anyone to guess or enumerate the address of a resource.

6. Secure development

We develop using version-controlled repositories and peer-reviewed changes, and we keep separate configurations for each environment. We monitor, patch and update software dependencies to limit exposure to known vulnerabilities.

7. Restricted infrastructure access

Access to internal systems, including databases and backend services, is limited to authorised personnel and protected by authentication.

8. Hosting, backups and recovery

The Service is hosted on Microsoft Azure in the UK South region. The database is backed up daily, and backups are kept for 7 days and then overwritten.

9. Monitoring and incident response

Application activity and errors are logged and kept for 30 days. We have an incident response process for investigating, containing and fixing security incidents. If a personal data breach affects your Content, we will tell you without undue delay, and give you the information you need to meet your own reporting duties, as set out in our Data Processing Agreement.

10. AI providers and other sub-processors

We use carefully chosen providers for hosting, AI processing, payments and support. Each is bound by a written contract with data protection and security terms. Our list of sub-processors is in the Data Processing Agreement. We do not allow AI providers to train their models on your Content or Output.

11. Access to your Content within FilmTailor AI

Our staff do not routinely view your Content. Access is limited to people who need it to provide support, keep the Service secure or meet legal obligations. Our team is bound by confidentiality obligations and receives security and data protection training.

12. Your responsibilities

Security is shared. Please use a strong, unique password, keep your login details private, remove people from your workspace when they leave a production, share call sheets and schedules only with those who need them, and tell us promptly at support@filmtailor.ai if you suspect unauthorised access.

13. Reporting a security issue

If you believe you have found a vulnerability, please follow our Responsible Disclosure Policy or email support@filmtailor.ai. We will acknowledge reports promptly and keep you informed while we investigate.

14. Contact

For security or privacy questions, email [support@filmtailor.ai. Our Privacy Policy and Data Processing Agreement give more detail on how we handle personal data.

‍