Security & Data Handling

What we process

Your uploaded videos, the audio transcripts generated from them, edit decisions and exports, your brand kit, plus account and billing metadata. B-roll is sourced from licensed stock libraries.

Use of your uploads

Uploads are used to produce your edit. You can opt out of having them used to improve our models when you sign up. See the Privacy Policy.

Encryption in transit and at rest

• In transit: [PLACEHOLDER: confirm TLS 1.2 or higher is enforced for all connections to the site and the app].
• At rest: [PLACEHOLDER: confirm encryption at rest for file storage, databases and backups].
• Passwords: [PLACEHOLDER: confirm passwords are stored only as salted hashes].

Access controls

• Access to customer content is limited to people who need it to run or support the service, on a least-privilege basis. [PLACEHOLDER: describe who at [PLACEHOLDER] BrollBot Ltd. can access content and under what circumstances, for example support with your permission.]
• Access to production systems is restricted and logged. [PLACEHOLDER: confirm multi-factor authentication for staff and admin accounts.]
• Within your own account, you control who can see your projects and brand kits.

Infrastructure

The service runs on established cloud providers that maintain industry-standard physical and network security. Our current providers are listed in the sub-processor table below. [PLACEHOLDER: state hosting regions and data residency options.]

Monitoring, logging and incident response

• We monitor systems for errors and suspicious activity, and keep audit logs to support detection and investigation. [PLACEHOLDER: confirm tooling in use.]
• If we confirm a security incident affecting your data, we will investigate, contain it, and notify affected customers and regulators within the time the law requires.

Backups and availability

[PLACEHOLDER: describe backup frequency, retention and how recovery is tested.] We do not guarantee uninterrupted availability; see the Terms.

Secure development

We review our code and third-party dependencies, apply security updates promptly and keep secrets out of source code. [PLACEHOLDER: confirm automated dependency scanning and code review practices.]

Retention and deletion

• Uploads and exports are deleted automatically after 30 days.
• You can delete a project earlier at any time. [PLACEHOLDER: confirm how long deleted data remains in backups.]
• To delete your account and data, email support@brollbot.example. We will confirm when it is done.

Payments

Card payments are handled by Stripe, a PCI DSS Level 1 certified payment provider. We never see or store your full card number.

Sub-processors

These providers process data on our behalf. We choose them with care and bind them to appropriate data protection terms.

Your responsibilities

Security is shared. Please:

• use a strong, unique password and keep it private;
• turn on any additional account protection we offer;
• only share projects with people who need them;
• keep your own backups of source footage;
• tell us straight away if you think your account has been compromised.

Reporting a vulnerability

If you believe you have found a security issue, email support@brollbot.example with a clear description, the steps to reproduce it and any proof of concept. Please:

• give us a reasonable time to investigate and fix it before you disclose it publicly;
• avoid accessing, changing or deleting data that is not yours, and avoid actions that degrade the service;
• not use social engineering, physical attacks or denial-of-service testing.

We will acknowledge your report as quickly as we can and keep you updated. [PLACEHOLDER: add a dedicated security contact, response targets and any safe-harbour wording your lawyer approves.]

Certifications

We do not currently claim any security certification (such as SOC 2 or ISO 27001). If that changes, we will say so here.

Related policies

See our Privacy Policy for how personal data is handled and our Cookie Policy for browser storage.