Sign inStart creating

Trust

Your content is yours. We never train on it, and we say precisely what that means.

Our commitments

Your content never trains a model

Prompts, uploads, Story and Character Bibles, generated outputs and finished films are never used to train, fine-tune or evaluate any model — ours or a provider's. This is a contractual commitment, not a default setting you have to find and switch off.

The exception, stated plainly: Routing analytics use metadata only — which model ran, how long it took, whether the creator kept the result, and the shot type it was for. No prompt text, no image, no audio and no script content is included in that data.

Providers are held to the same rule

Every model provider we route to is contracted on zero-retention, no-training terms for customer content. A provider that will not agree to those terms is not added to the Router.

The exception, stated plainly: Where a provider offers a training-eligible cheaper tier, we do not use it, and its price is not quoted in our estimates.

Deletion means deletion

Deleting a project removes its assets, its graph and its provenance records from live systems immediately and from backups within 30 days. Account deletion removes everything except records we are legally required to retain.

The exception, stated plainly: Consent records for voice and likeness are retained in anonymised form after account deletion. They are the proof that permission was given, and destroying them would destroy the defence of everyone who relied on them.

You can ask where it ran

Every generation records which provider executed it and in which region. Enterprise plans can restrict routing to named providers or regions, and the Router refuses rather than silently falling back outside them.

SOC 2 readiness

5 of 10 controls are in place, 4 partially, 1 not yet started. Firefly Reels is NOT SOC 2 certified — this is a readiness programme, and no control is counted as met until it is running in the product.

Readiness programme — early5 in place4 partial1 not started
CC6.1

Logical access controls

SecurityIn place

Every server action carries an ownership guard, audited by scripts/audit-actions.ts. Project and admin pages gate before any query rather than after render.

CC6.2

Credential lifecycle

SecurityIn place

Provider keys and OAuth tokens are encrypted at rest; API keys are hashed, scoped, spend-capped and revocable; plugin sessions revoke their key with the session.

CC6.6

Multi-factor authentication

SecurityIn place

TOTP and passkeys are available to all users, and 2FA is mandatory for admin accounts in production — enforced at the page level, not only in the layout.

CC7.2

Audit logging

SecurityIn place

AdminAuditLog is append-only: rows are never updated or deleted, including impersonation, credential rotation and credit adjustments.

CC7.3

Incident response

SecurityPartial

Status incidents are recorded and published, and provider outages fail over automatically. A written incident-response runbook with named on-call roles is not yet in place.

CC8.1

Change management

Processing integrityPartial

A 29-stage verification suite plus adversarial bots gate every change, and pricing changes are versioned with effective dates. Formal change-approval records with separate reviewer sign-off are not yet kept.

CC9.2

Vendor management

SecurityPartial

Every model provider is registered with its licence posture and terms reviewed, and Cleared Content mode routes only to licensed-data engines. An annual vendor re-review cycle is not yet scheduled.

A1.2

Backup and recovery

AvailabilityNot started

Depends on the production database and object store, which are not yet provisioned. Restore testing is scheduled with that work.

C1.1

Confidential data handling

ConfidentialityIn place

Customer content is never used for training (see the pledge). Card data goes token-only to Stripe and never touches these servers.

P4.2

Data retention and disposal

PrivacyPartial

Download-my-data and delete-account flows exist and work. The 30-day backup purge window is documented but cannot be evidenced until backups exist.