Security

Every control,written down.

Screenshot Studio is built for the security review. One authorization path for every request, an audit log the application cannot edit, private storage scoped to your organization, and AI that treats the internet as untrusted.

Request a security review Enterprise

Audit logappend-only · example

10:42:07	[email protected]	product.campaign_post_status_changed	approve · 7 posts
10:41:55	api key · ci	release.created	Recurring invoices
10:39:12	[email protected]	member.role_updated	creator → approver
10:37:40	system	post.published	receipt stored

Access

Who gets in,and what they can do.

Sign-in, roles, and identity are built on Better Auth organizations. Each organization is a tenant.

Single sign-on
SAML and OIDC, plus Google, Microsoft, and GitHub sign-in. Password sign-in can be switched off.
SCIM provisioning
SCIM tokens are scoped to one organization and stored as hashes. Deprovisioned people lose access.
Two-factor
TOTP. A fresh two-factor session is required to configure SSO or SCIM and to connect social channels.
6 fixed roles
owner, admin, creator, approver, publisher, viewer. Approving and publishing are separate permissions.
Sign-in limits
Sign-in attempts are limited to 10 a minute.
Scoped API keys
Five scopes, hashed at rest, shown once, and revoked on the next request. No key can approve or publish.

Authorization

One path.Nine steps. No shortcuts.

Every request takes the same path, in the same order, and ends with an audit entry written in the same transaction as the change.

1
Authenticate
2
Active organization
3
Membership
4
Role
5
Permission
6
Workspace operational
7
Tenant context
8
Mutation
9
Audit, same transaction

Client permissions control presentation; server permissions control security.

Playbook Core

Your data

Yours,and nobody else's.

Tenancy comes from the signed-in principal, never from the request. An ID from another organization returns 404, so IDs cannot be enumerated across tenants.

org/<organizationId>/…
Private storage
Files live in a private bucket with no public domain, under a path the backend refuses to cross between organizations.
signed URL · 2 min
Short-lived links
Uploads and downloads use signed URLs that expire in two minutes. Uploads are write-once, and a replay is refused.
two-tenant test
Isolation, tested
An automated test with two organizations proves sessions and API keys cannot reach the other organization’s releases or assets.
web → backend SDK
No database in the web app
The web application has no database connection and no storage credentials. A test enforces it.
grace period · tombstone
Deliberate deletion
Deleting a workspace starts a grace period. Afterward an organization tombstone and the audit evidence remain.
United States
Where it runs
The application runs in the United States, in DigitalOcean’s New York region, with workflows in AWS US East. Regional data residency is not offered today.

Audit

A record nobodycan quietly change.

The audit log is append-only by database permission, not by convention. The application role can insert and read audit rows and nothing else.

Append-only
Redacted, per-organization entries, searchable by time, action, actor, outcome, entity, and text.
Hashed IPs
IP addresses are stored as keyed hashes, not raw values.
Retention and legal hold
Ninety days by default. Enterprise sets a longer period or places history on legal hold.
SIEM drains
CloudEvents JSON to any HTTPS endpoint with an HMAC SHA-256 signature, or presets for Splunk and Datadog.
Encrypted drain secrets
Drain credentials are encrypted at rest with AES-256-GCM and never shown back.
Delivery that retries
Drains deliver every minute, reject private addresses and redirects, and retry without blocking your work.

Untrusted in,audited out.

AI features read untrusted text and are treated as untrusted themselves. They run inside one workspace, hold no credentials, and cannot approve anything.

No training on your content
Your history is retrieved at generation time for your workspace only. No model is trained on it.
Injection defense
Sources are sanitized, fenced, and flagged. Read the guardrails.
Metadata, not prompts
AI actions are audited with the model and usage. Prompt and completion text are kept out of the audit log.

Providers

What we run on.And why.

The services the hosted platform runs on, and what each one does. Self-hosting replaces any of them with your own.

Infrastructure providers
Provider	Purpose
DigitalOcean App Platform	Application hosting, in the New York region
PlanetScale	Managed PostgreSQL
Upstash	Redis for rate limits and caching
Cloudflare R2	Private object storage for assets
Cloudflare Browser Rendering	Headless rendering of designs
Temporal Cloud	Durable workflows for publishing and maintenance, in AWS US East
Resend	Account, invitation, and release email
OpenRouter	Model routing for AI features
Microlink	Screenshot capture API
PostHog	Product analytics

Questions

Anything else? Talk to us.

Do you have SOC 2 or ISO 27001?

Not today. The architecture, controls, and their tests are documented in the open-source repository, and we will walk your team through them.

How do I report a vulnerability?

Can we run it in our own cloud?

Yes. Docker images and a Helm chart ship in the repository, so the whole platform can run on your infrastructure.

Who can see our workspace?

Only your members, through the roles you assign. Every read and write is scoped to your organization.