Security
This page describes the controls protecting your account and your Customer Content. It is written to answer the questions that come up in security reviews, and it describes what we do today rather than what we intend to do.
01Encryption
All traffic between your browser or desktop app and our systems is encrypted with TLS 1.2 or better. Stored data is encrypted at rest by our infrastructure providers: application data in Convex, and media in Cloudflare R2.
On the desktop app, your session credentials are encrypted with the operating system keychain — Keychain Services on macOS and DPAPI on Windows — rather than being written to disk in plain text.
02Authentication
Accounts are managed by Better Auth. Passwords are stored only as salted hashes and are never recoverable, including by us. You can alternatively sign in with a supported identity provider, in which case we never see a password at all.
Sessions are held in signed, httpOnly cookies. The desktop app authenticates by handing off to your browser and exchanging a single-use token, so your credentials are never typed into the desktop application itself.
03Tenancy isolation
Every project, asset, timeline, and credit transaction is scoped to a workspace, and every server-side read and write re-derives your identity from the request’s signed token rather than trusting any identifier supplied by the client. Authorization is enforced in the backend, not in the interface.
Media URLs are issued as short-lived signed links rather than public-readable paths, so an asset link that leaks cannot be replayed indefinitely.
04Internal access
Access to production systems is limited to the engineers who need it to operate the service, protected by multi-factor authentication, and granted through least-privilege service accounts rather than shared credentials. We access Customer Content only when you ask us to for support, or where strictly necessary to investigate abuse or a security incident.
05Abuse and rate limiting
Actions that spend money at a third-party provider are metered against your credit balance and additionally throttled per workspace, so a compromised session or a runaway integration cannot drain an account without hitting a ceiling. Storage is quota-enforced at upload time rather than reconciled after the fact.
06Monitoring and incident response
Errors and crashes are reported to Sentry with personal content scrubbed before transmission. Backend operations emit structured audit records — generation attempts, credit movements, storage reconciliation — which is what we use to investigate incidents.
If a breach affects your personal information, we will notify affected users and, where required, the relevant supervisory authority within the timeframes set by applicable law.
07Subprocessors and data residency
The complete list of vendors that process data on our behalf, what each receives, and where it is hosted, is published at superbloo.com/subprocessors. Analytics and error reporting are hosted in the European Union; our core application data is hosted in the United States.
08Certifications
Superbloo is an early-stage company and does not yet hold a SOC 2 or ISO 27001 attestation. We would rather say so plainly than imply coverage we do not have. If a formal attestation is a requirement for your organization, contact security@superbloo.com and we will share our current roadmap and complete a security questionnaire.
09Your part
Use a unique password, keep your identity provider secured with multi-factor authentication, remove workspace members promptly when they leave, and treat exported media and shared links as public once they leave the product. If you believe your account has been compromised, contact security@superbloo.com immediately.