Our security posture
Security for your media and the systems around it
FileSpin combines controlled access, encrypted data, tested database recovery and reviewed software releases to protect business-critical media workflows.
For enterprise customers, we support security reviews with information about our controls, infrastructure and data‑processing arrangements.
Protection throughout the workflow
Encrypted data
Data is encrypted in transit and at rest, including FileSpin-managed databases and backups.
Controlled production access
Production access is restricted to authorised personnel, protected by multi-factor authentication and reviewed regularly.
Tested recovery
Daily database backups and continuous write logs support point-in-time recovery. Restore tests run every three months.
Around-the-clock incident coverage
Our DevOps team receives security alerts with 24/7 coverage throughout the year.
Access with accountability
Access to production systems is limited to the people who need it to operate and support the service.
Multi-factor authentication protects production access.
Access permissions are reviewed at least quarterly, with records retained.
Access is revoked within 24 hours of departure or a relevant role change.
Computers used for production access are company-owned, encrypted, kept updated, screen-locked and protected against malware.
Personnel with customer-system access complete security and data-protection training, with completion recorded.
Secure development and releases
Every change follows the same path to production, kept separate from development and test.
Resilience and recovery
FileSpin-managed databases are protected by daily full backups and continuous write logs, supporting recovery to a specific point in time. Backups are retained for 15 days, and restore tests take place every three months.
For deployments using customer-owned storage, responsibility for media backup and recovery remains with the customer. We clarify these boundaries as part of the deployment and service agreement.
Database recovery controls
Daily full backups
Continuous write logs
Point-in-time recovery
15-day backup retention
Quarterly restore testing
Monitoring and incident response
Security logs and application audit logs support investigation and operational accountability. Our DevOps team receives security alerts with continuous, year-round coverage.
If an incident affects a customer, we provide an initial notification under the applicable contractual requirements, share the facts available and provide updates as the investigation progresses.
Infrastructure and data handling
Hosting and delivery
We explain the infrastructure providers, storage locations and content-delivery arrangements relevant to your deployment during the enterprise review process. Storage location and CDN delivery are distinct: content delivery may use a global network.
Customer-owned storage
FileSpin supports deployments using customer-owned S3 storage. Customers retain control of their buckets, while FileSpin manages the application and database services within the agreed scope.
Data-processing agreements are in place with the infrastructure providers used for enterprise deployments. Deployment-specific supplier information is available as part of security due diligence.
AI with explicit customer approval
AI functionality can remain disabled for enterprise deployments. For deployments configured on this basis, customer files and personal data are not sent to AI providers without the customer’s express approval.
Before enabling AI, we work with the customer to confirm the use case and applicable data-processing arrangements.
Data return and deletion
We support the return and deletion of customer data from FileSpin-managed systems under the applicable agreement.
For enterprise deployments, arrangements can include return and deletion within 30 days of termination or an agreed deletion request. Database backup copies expire under the applicable retention policy. Customer-owned storage remains under the customer’s control.
Questions
Clear service boundaries
Security information for your review
Your security team needs clear answers about the service it is assessing. Contact us to discuss:
Security questionnaires and control summaries
Hosting locations and infrastructure providers
Data-processing arrangements
Backup, recovery and retention responsibilities
Incident notification requirements
AI configuration and approval requirements