How KitSlate protects your work

Updated 2 November 2026

Plain answers about where your footage and records live, who can open them, and what we do to keep them safe.

The formal version is our Security statement. If anything here and there ever differ, that statement is the one that counts.

Every transfer has its own link with a random code. You choose who can open it.

Anyone with the linkQuick and simple. Anyone you pass the link to can open it.
Anyone, after confirming their emailThey type a six-digit code we email them. A code works for 10 minutes and five tries.
Only the people you send it to, after confirming their emailNobody else can open it, even with the link.
A passwordAdd one to any transfer. We store it scrambled, never as text, and stop wrong guesses after 10 tries an hour.
An end dateA link ends on the day you choose, from 1 to 30 days. On Studio and above you can also keep a link open with no end date.
Stop sharingEnds a link straight away, whatever its end date.
ActivityYou see who opened, played and downloaded what, and when.

How your files are moved and stored

Always over HTTPSEvery connection to KitSlate is encrypted. Browsers are told never to use a plain connection.
Where it livesFiles you send are stored with Cloudflare. Your account records are stored with Supabase, on Amazon Web Services in the United States.
Encrypted on their disksBoth providers encrypt everything they store.
What we do not claimKitSlate does not add its own encryption to the files you send. Anyone who can open a transfer can open its files, so choose who can open it.
The desktop appIn KitSlate Desktop, nothing leaves your computer until you send it.

Google or an emailed linkYou sign in with your Google account or with a one-time link we email you.
SessionsA session lasts an hour and renews itself while you work. Signing out ends it on our side too.
No second step yetKitSlate has no two-factor sign-in of its own yet. Your email account is the key, so turn on two-factor at Google or with your email provider.

Payments

Stripe handles cardsCard payments happen on Stripe’s own secure pages. KitSlate never sees or stores a card number.

Backups

Every nightYour account records are backed up every night.
Encrypted firstEach backup is encrypted before it leaves our systems. We keep 14 daily, 8 weekly and 12 monthly copies.
Tested every nightEach night the newest backup is restored into a test database to prove it works.
What is not backed upFiles you send through transfers are not in these backups. They are kept only until their link ends.

Deleting your data

When a link endsIts files are removed by a clean-up every 15 minutes.
The transfer’s historyThe record of who opened and downloaded it is kept for 12 months after the link ends, then deleted.
Take everything with youYou can export your whole workspace at any time from Settings.
Closing your accountEmail [email protected] and we delete your account and its data.

Who at KitSlate can see your data

No browsing toolThere is no staff screen for looking through customers’ files or records.
Locked-down systemsAccess to the systems behind KitSlate goes through each provider’s own sign-in and is used only to run and support the service.
One workspace, one ownerEvery table in our database checks who is asking, so one workspace can never read another’s records.

How we build and release

A separate test copyEvery change is tried first on a staging copy of KitSlate with its own database and storage.
Hundreds of checksA release reaches kitslate.app only after it passes several hundred automated checks. They include checks that card data is never handled and that no live keys are written into the code.
A way backEvery release can be rolled back to the version before it.

Our suppliers and their audits

KitSlate is built on providers that are independently audited. Each one’s reports are available from its own trust page.

Supplier	What it does for KitSlate	Its audits
Supabase	Database, sign-in and stored records	SOC 2 Type II
Cloudflare	The website, transfer storage and email routing	SOC 2 Type II, ISO 27001
Stripe	Payments	PCI DSS Level 1, SOC 2
Resend	Sending email	SOC 2 Type II
GitHub	Makes the nightly backup	SOC 2 Type II
Google	Google sign-in, Calendar, and storage for encrypted backups	SOC 2, ISO 27001
Anthropic	AI features	SOC 2 Type II

Every supplier, including the small ones, is on our Subprocessors page.

For security reviews

Answers to the questions security teams ask most. To keep a copy, use your browser’s Print.

Do you have a SOC 2 or ISO 27001 report?: Not yet. Our hosting, database, payment and email providers do, as the table above shows. We will commission our own when clients need it.
Has KitSlate had an independent penetration test?: Not yet.
Is data encrypted in transit?: Yes. Every connection uses HTTPS, and browsers are told to use nothing else.
Is data encrypted at rest?: Yes, by our storage providers, Cloudflare and Supabase. Backups are also encrypted by us before they are stored.
Where is data stored?: Account records are with Supabase on Amazon Web Services in us-east-1, United States. Transfer files are with Cloudflare. Full details are on the Subprocessors page.
How is one customer kept from another customer’s data?: Row level security on every table in the database. Each request can only reach its own workspace’s rows.
Do you support two-factor sign-in or single sign-on?: Sign-in is with Google or a one-time emailed link. Two-factor is available through Google or your email provider. KitSlate has no two-factor of its own and no SAML single sign-on yet.
How do you control who can open a shared file?: By link, by confirmed email, by named recipients, by password, by end date and with Stop sharing. Every open, play and download is logged for the sender.
Do you handle card data?: No. Payments go through Stripe’s hosted pages.
What do you log?: Sign-ins, changes to key records and every open, play and download of a transfer. The audit log cannot be edited or deleted from the app.
How are backups made and tested?: Every night, encrypted, and kept as 14 daily, 8 weekly and 12 monthly copies. The newest is restored into a test database every night.
How long do you keep data?: Transfer files until their link ends. A transfer’s history for 12 months after that. Account records until you ask us to delete them.
Can we get our data out?: Yes. Export your whole workspace from Settings at any time.
How do changes reach production?: Through a separate staging copy and several hundred automated checks. Only a certified release can be deployed, and each one can be rolled back.
Who can access production systems?: Only the people who run KitSlate, through each provider’s own sign-in, to operate and support the service.
What happens if there is a breach?: We tell affected customers without undue delay, and within the time the law requires, with what happened, what data was involved and what to do. The full commitment is in section 12 of our Security statement.
Is there an uptime commitment?: Not a contractual one. Live status is on status.kitslate.app.
Can we sign a data processing agreement?: Yes, on request. Email [email protected].
Is KitSlate suitable for health or government data?: No. It is not designed for health, biometric or classified information.

Need your own questionnaire filled in? Send it to [email protected].

Report a security problem

Email [email protected].

We will not take action against anyone who reports a problem in good faith and follows the rules in section 14 of our Security statement.