Security
Flask runs on managed cloud infrastructure — we operate no servers or data centers of our own. Application data is hosted in the United States.
How we protect your data
Encrypted in transit
All traffic between your browser and Flask runs over TLS (HTTPS). Data at rest is encrypted by our infrastructure providers.
Least-privilege access
The public database key has no read or write permissions. Every byte of data is brokered through our authenticated backend API.
Three-tier permissions
Content is scoped to its creator, invited team members, and — only when you explicitly enable it — public share links.
AI processing
The assets you review and the feedback you record are treated differently. Only your recordings are ever sent to an AI model.
Your assets
The videos and images you upload for review are stored and streamed for playback only. They are never sent to, or processed by, any AI model.
Your recordings
Voice, camera, and screen recordings you leave as feedback are transcribed by ElevenLabs, and the resulting text is processed by Google Gemini to structure and summarize your feedback. Only your recordings are processed this way — never the asset they are attached to.
Data retention
When you upload a file, we keep the original master file available for you to download for 30 days. After 30 days the original master file is deleted. This does not affect the asset itself — the processed, streamable version stays available; only the original upload is removed.
Authentication
Accounts authenticate through Supabase Auth, supporting both email and OAuth sign-in. We never store your password. Access to folders and assets is authorized in application code on every request — not left to the database alone.
Payments
All payments are processed by Stripe. Flask never collects, transmits, or stores your full card details — that is handled directly by Stripe, a PCI-DSS Level 1 certified provider.
Stripe's privacy policySubprocessors
A small set of third-party services operate Flask. Each processes only the data needed for its function.
Compliance
We design our data handling to align with GDPR and UK GDPR. We are not currently certified under the frameworks below. If your team has specific compliance requirements, get in touch.
Report a vulnerability
Found a security issue? Email us with details and steps to reproduce. Please allow us reasonable time to fix it before public disclosure.