Slate
SECURITY & TRUST

How Slate handles your cut, your bids, and everything in between.

This page is maintained by the Slate team to answer the security and privacy questions we get most often. It reflects how the app runs today — not a certification. If something here matters for your studio and it's not covered, email us and we'll answer directly.

Hosting & encryption

  • Application, database, and object storage all run on managed cloud infrastructure in the United States (AWS us-east region, via our platform provider).
  • All traffic between your browser and Slate is served over HTTPS with TLS 1.2 or newer.
  • Data at rest — Postgres rows and uploaded media — is encrypted with AES-256 by the underlying platform.
  • The database is backed up daily by the platform. Point-in-time restore is available to the Slate team.

Access control & invites

  • Slate is invite-only during beta. Anyone can request access at /request-access; only the Slate team can approve a request and issue an invite email.
  • Once inside, users belong to one or more organizations. Every project belongs to exactly one organization, and every row (bids, markers, shots, notes) is scoped to that org in the database.
  • Access is enforced server-side with row-level security. A user only sees rows for organizations and projects they've been explicitly added to — even a crafted request can't read across orgs.
  • Per-project roles (owner, admin, editor, viewer) control who can edit versus only view. Org admins manage members and project access from inside the app.

Media handling

  • Uploaded QuickTimes and captured frames are stored in private buckets. There are no public URLs — media is served exclusively through short-lived signed links (video: 30 minutes, thumbnails: 15 minutes) that expire on their own and are auto-refreshed in-session at ~80% of their lifetime so a copied link can't be replayed later.
  • Bucket read policies are scoped by row-level security: reference videos and shot thumbnails are readable only by their uploader (auth.uid() = owner). The onboarding demo bucket is gated to users who currently have a demo project provisioned; there are no world-readable objects anywhere in Slate.
  • Each object is tagged with the uploader's user and org on write, so signed-URL requests are checked against the same access rules as everything else.
  • You can also work fully local: load a QuickTime from your machine and Slate never uploads it. Nothing leaves the browser unless you use the Upload action explicitly.
  • Deleting a shot, marker, or project removes the associated media on the same request — no soft-delete waiting period.

Dedicated infrastructure (paid upgrade)

  • The default Slate deployment is multi-tenant: every studio's data lives in the same Postgres cluster, isolated by row-level security. That is enough for most teams.
  • For studios that need stricter isolation — a signed DPA, data residency in a specific region, or an auditor asking for single-tenant hosting — we offer a dedicated Postgres + object storage instance provisioned per-studio. Your rows, your media, your database credentials.
  • The dedicated tier can be hosted in a Slate-managed AWS account (US, EU, or Canada) or, for enterprise engagements, deployed into your own AWS/GCP account and operated by our team. Backups, upgrades, and monitoring are included.
  • This is a paid upgrade sold alongside the customization work below — talk to us about your studio's compliance and residency requirements and we'll scope it.

AI data handling

  • AI features only send data to a model provider when you explicitly trigger the action. Slate does not background-scan your projects.
  • What's sent is scoped to that action: the marker's captured frame, the shot code, and any note or transcript text you asked to be considered.
  • Providers we use do not train their models on API traffic from Slate.
  • Optional BYO key (available now in workspace settings): paste your own OpenAI, Anthropic, or Google key at the org level and requests bill to your provider account instead of ours. The raw key is encrypted at rest, only decrypted server-side at call time, and never returned to the browser.
  • Frame text recognition for auto-markers runs locally in your browser first; a model provider is only called as a fallback for frames the local pass can't read confidently.
  • AI usage (which action, which org, token counts) is logged so admins can see spend. Prompt and response contents are not retained for training or analytics.

AI levels & your NDA

  • Every workspace sets an AI level, and any project can be set stricter than its workspace: Off (no AI at all), Metadata only, Metadata + media, or Full. The level is enforced server-side, so a blocked feature can't be reached by a crafted request either.
  • Metadata only sends nothing but your question and the shot names, scene numbers and day counts you typed into Slate yourself — this is what Ask Slate uses. Asking how many dragon shots you have runs a query against your own rows; no script or footage is involved.
  • Metadata + media adds burn-in reading and dictation: a cropped burn-in strip or the audio clip you just recorded, sent only when you press the button. Playing, scrubbing, marking and bidding a QuickTime never calls a model at any level.
  • Full adds the script features — breakdown, audit and vendor return parsing — which do send the screenplay pages or vendor document you upload for that task. This is the level worth checking your NDA against.
  • What an NDA usually turns on: whether third-party processors need prior written approval, whether processing is restricted to a region, whether metadata about the material is treated differently from the material itself, and whether every downstream vendor needs its own signed NDA or DPA. Business-tier model terms cover training and retention — they are not a signed NDA with your client.
  • If the answers are unclear, start at Metadata only. Ask Slate, Quick Bid and bulk edits keep working while scripts stay inside Slate, and the level can be raised per project once you have written approval.

Private & dedicated AI

  • BYO key (today): add your own OpenAI, Anthropic or Google business key in Workspace → AI keys. Requests bill to your account, run through the same frontier models, and are covered by your provider DPA. This is the fastest way to remove the 'whose account is this running on?' concern.
  • Dedicated AI endpoint: for studios that need a single-tenant model endpoint in a specific region, we can provision a private inference instance (AWS or Azure) that no other Slate customer shares. You trade the very latest frontier models for a fully isolated pipeline — we will be honest about which models are available and where quality differs.
  • Air-gapped / customer-cloud deployment: for enterprise engagements, the AI inference layer can run inside your own AWS or GCP account with no outbound model traffic. This is the strongest isolation and the highest operational cost; it is scoped as a paid professional-services engagement.
  • QuickTime and scripts are treated differently: playing, scrubbing or bidding a QuickTime never calls a model. Script breakdown and vendor-return parsing are the features that send documents, so those are the ones to evaluate against your NDA and choose an isolation tier for.

Most studios solve the AI concern with a BYO business key and a project-level AI level set to Metadata only until legal confirms script AI is approved. Talk to us if you need dedicated or air-gapped inference and we'll scope the trade-offs honestly.

Audit trail & recovery

  • Edits to bids, shots, markers, and tags are recorded in a per-project activity log with the acting user, the field changed, and the before/after values.
  • Users with editor access or higher can undo their team's recent changes from that log for up to 7 days; older entries stay readable as history.
  • Locked bid versions are enforced in the database, not just the UI — a locked version can't be edited even by a crafted request.

What we don't do

  • We don't sell, share, or license your projects, cuts, or bids to anyone.
  • We don't allow anonymous sign-ups. Every account is created through an invite email from someone with the authority to issue one.
  • We don't email you marketing about competitors, and we don't put trackers on this security page beyond what's needed to serve it.
  • We don't publish a compliance badge. If you need SOC 2, HIPAA, GDPR-DPA, or a signed security questionnaire, email us — we'll tell you honestly where we are.

Reporting a vulnerability

  • If you think you've found a security issue in Slate, please email info@whatifi.io before disclosing publicly.
  • We aim to acknowledge reports within two business days and will keep you posted while we investigate.
  • We don't run a paid bounty yet, but we'll credit reporters who ask for it.
Still have a question?

Email info@whatifi.io and a human will get back to you — usually the same day.