Security
How post-prod.io keeps your cuts safe
What we do today, stated plainly. If you need something that is not on this page, ask us before you rely on it.
No certification yet. post-prod.io does not hold SOC 2 or ISO certification yet.
Who can see what
- Every request is checked against who you are and what you were given access to.
- Video and images are served through signed links that expire within hours, so a copied link stops working.
- Database tables are reachable only by post-prod.io's server: row-level security is on and there is no public access.
Share links
- A share link can have a password, an expiry date, downloads turned off and a watermark.
- Reviewers on a link need no account. They see only what that link covers.
Your data
- Nightly database backups, kept for 14 days.
- You can download your data, and delete your account or your workspace yourself.
- Uploads resume after a dropped connection.
- Notes you are writing are kept on your device if your browser crashes.
Where your data is hosted
- App servers
- Fly.io, London
- Database
- Supabase, EU (Ireland region)
- Files
- Cloudflare R2
What goes to AI providers
- AI checks
- The preview copy of a video is sent to Google Gemini.
- Voice notes
- Sent to OpenAI Whisper and Anthropic Claude.
The privacy page lists every service that helps run post-prod.io and what each one gets.
Found a security problem, or need more detail for a review? Email contact@retti.ai.
Start on the free plan
10 GB, unlimited members and reviewers, every feature. No card needed.