Security

A script, a budget and a crew list are among the most sensitive things a production owns. This page describes how Storiara protects them. Our policies, documents and current compliance status are in our trust center at trust.storiara.com.

• Storiara runs on Google Cloud in the United States. Google operates the data centers, the network and the operating systems.
• The database is stored across multiple regions.
• Storiara runs no servers of its own.

• In transit: every connection uses HTTPS with TLS.
• At rest: the database and all files are encrypted.
• Dedicated customer environments: the database and files are encrypted with customer-managed keys.

• Every read and write is checked against project membership and role. Anything the rules do not allow is refused.
• Project roles limit who can see budgets, scripts and other areas: Owner, Producer, Assistant director, Cinematographer, Department head, Accountant and Crew (view).
• Each project has an activity log of changes and an access log of who opened, printed, exported or sent what.
• Sign in with email and password, Google or Apple.

• AI features run on Google Gemini models on Google Cloud, under Storiara’s own cloud account.
• We do not use your content to train AI models, and Google Cloud’s terms say customer data is not used to train its models.
• Storiara does not store the prompts sent to the models.
• Every amount in a budget is calculated by rules. No amount comes from a model.

• The database is backed up every day and protected against deletion.
• All files are copied every day to separate storage held in two other regions, with earlier versions kept.
• Backups are kept for 7 days.
• Recovery point objective: 48 hours. Recovery time objective: 24 hours.

• Google Cloud audit logs record administrator activity and access to the database, files and sign-in.
• Alerts notify us of function errors and unusual database activity.
• Current availability and 90 days of history are at status.storiara.com.
• Our cloud, source code and identity accounts are monitored continuously through Vanta.

• Every change is checked automatically before release: type checks, linting, unit tests, tests of the access rules and a production build.
• Changes go to a beta environment before production.
• Deploys sign in to Google Cloud without a stored key.
• Dependencies are monitored for known vulnerabilities.
• Releases are listed in our changelog.

For studios and larger productions, Storiara can run in an environment used by one customer only:

• A separate Google Cloud project with its own database, files, user directory, secrets and encryption keys
• Customer-managed encryption keys for the database and files
• Accounts by invitation only
• Two-step sign-in with an authenticator app, which can be required for everyone
• Company single sign-on over SAML or OIDC, and SCIM user provisioning
• Audit logs delivered to your own security monitoring system
• Removal of the whole environment at the end of an engagement

To talk about a dedicated environment, contact us.

• You can delete a project or your account at any time from inside Storiara.
• Copies held in backups expire within 7 days.
• Our Privacy Policy explains what we collect and how long we keep it.

Storiara is working toward SOC 2 with Vanta. Our security policies cover access control, data management, cryptography, secure development, operations security, incident response, business continuity and disaster recovery, risk management, third-party management and human resource security.

If you believe you have found a security problem in Storiara, email [email protected]. Please include the steps to reproduce it and give us a reasonable time to fix it before sharing it with anyone else.