Security

1. Our principles

• Least privilege — every seat, service, and operator gets the smallest set of permissions needed to do the job.
• Tenant isolation— an agency’s workspace, its clients, and their voice profiles are scoped so one agency cannot reach another’s data.
• Defence in depth— auth, network, storage, and application controls overlap so a single failure isn’t catastrophic.
• Honesty over theatre— this page describes controls we actually run, not controls we aspire to. Certifications we don’t hold are not listed.

2. Authentication and access

• User authentication is handled by Clerk. Passwords are never stored by Repodcast; Clerk uses bcrypt with a per-user salt.
• Multi-factor authentication is available to every workspace and is enforced by policy for internal staff with elevated access.
• Session tokens are short-lived, HTTP-only, and scoped to the workspace. Sessions can be revoked from Clerk’s security panel or by a workspace admin.
• Sign-up and sign-in traffic is rate-limited and monitored for credential-stuffing patterns.

3. Encryption

• In transit — all traffic to repodcastapp.com is served over TLS 1.2 or higher with modern cipher suites. HSTS is enabled.
• At rest— audio, transcripts, and generated content live in Amazon S3 with server-side encryption (AES-256, SSE-S3). Database storage uses the managed provider’s at-rest encryption.
• Secrets— API keys and credentials for subprocessors are stored in the hosting provider’s encrypted environment store and are never checked into source control.

4. Tenant isolation

Every database query and every S3 object read is scoped to the requesting workspace at the application layer. Server actions and route handlers derive the acting agency from the signed session and refuse cross-agency access. Portal tokens used by your clients are single-use, expiring, and scoped to a single client within your workspace.

5. Operator access

A very small number of Repodcast staff hold an operator role used for support, quality triage, and abuse response. That role is granted separately from the tenant workspaces you use day-to-day. Operator access:

• Requires an explicit operator grant plus multi-factor authentication.
• Cannot silently take over a workspace session — impersonation, when used for support, is signed and produces an audit-trail entry visible to Repodcast on review.
• Is logged. High-sensitivity actions (data export, workspace impersonation, forced deletion) produce an audit-trail entry retained for review.

6. Infrastructure

• Hosting— the application runs on Vercel’s managed platform in North America and Europe regions.
• Object storage — audio, transcripts, and generated content live in Amazon S3 with versioning and lifecycle policies.
• Background work — Inngest orchestrates transcription, generation, and scheduled delivery. Job payloads are signed and replay-protected.
• Uptime monitoring — health probes and error-rate alerts page the on-call engineer.

7. AI providers

Content is transcribed by Deepgram and generated by Anthropic. Both are contracted so that your content is used only to return the requested output — not to train their public foundation models. We restrict what we send: prompts include the minimum context a request needs, and we do not send billing, PII, or session tokens to model providers.

8. Subprocessors and vendor review

Every subprocessor we use is listed in the Privacy Policy. Before we adopt a new one we review their security posture, data-processing terms, and residency options. Workspace admins are notified by email before we add a subprocessor that materially changes the data-handling picture.

9. Development practices

• Code changes flow through pull requests with automated linting, type-checking, and unit + integration tests before merge.
• Dependencies are pinned; known-vulnerable versions are flagged by automated scanning and triaged.
• Feature flags gate risky launches; new abuse-adjacent surfaces are opt-in and monitored.
• Production access is broker-mediated; no engineer has standing access to production databases without a paged incident.

10. Backups and continuity

• Managed database is backed up daily; point-in-time recovery is available.
• S3 objects have versioning enabled. Deletes are soft for 30 days before the object is removed from primary storage.
• Restoration procedures are exercised periodically.

11. Incident response

We investigate every security signal. If we confirm a data incident that affects your workspace, we’ll notify the workspace admin without undue delay — and within any legally required timeline — with what happened, what data was involved, what we’ve done, and what we recommend you do. Report a suspected issue to security@repodcastapp.com at any time.

12. Responsible disclosure

If you believe you’ve found a vulnerability, please email security@repodcastapp.comwith reproduction steps and, if you’d like, a preferred handle for the acknowledgement. We commit to acknowledging within two business days and to keeping you posted while we investigate. We will not pursue legal action against researchers who act in good faith, respect user privacy, and give us reasonable time to fix an issue before public disclosure.

13. What we don’t have yet

We currently do nothold SOC 2, ISO 27001, or HIPAA certifications. If your procurement process requires any of these, tell us early — we’ll be straightforward about whether we can meet the requirement in the timeframe you have.

14. Contact

Security questions and reports go to security@repodcastapp.com. For content complaints, please use the report form instead.