Security and data handling
Where your data is stored
- Uploaded files, intermediate files and outputs are stored in Cloudflare R2 object storage. Backup copies of them are kept in a separate bucket.
- Workspace records (accounts and memberships, recordings, jobs, plans, exports, billing records and assistant conversations) are stored in PostgreSQL databases hosted by Railway in the United States.
- To process a job, the parts of your video it needs are sent to the compute and model providers listed on the Subprocessors page.
Encryption
- In transit: the service is served over HTTPS, and our calls to third-party providers use HTTPS.
- At rest: stored data relies on the encryption provided by our storage and hosting providers. FastCrest Cupel does not add its own application-level encryption on top of that today.
Workspace isolation
- Accounts and teams are managed through Clerk. Each organization gets its own FastCrest Cupel workspace, and your active organization and role are read from your verified sign-in token.
- The application checks your workspace and role before it reads or changes workspace data.
- The database also enforces workspace-scoped row-level security on the core tables for recordings, uploads, outputs, processing results and annotations. It does not yet do so on every table.
- Every stored file and output is identified by a hash of its contents, so a change to it is detectable.
Who at FastCrest can access your data
A small number of FastCrest engineers hold administrative access to the hosting, database and storage accounts, and so can technically access stored data. That access is not yet time-limited or separately recorded inside the product. We access customer content only to run or support the service, to investigate a problem you report, or where the law requires it.
Retention and deletion
- FastCrest Cupel keeps your uploads, outputs and workspace records until you delete them. It does not delete them on a schedule. Uploads that were started but never finished are cleaned up after 24 hours.
- A workspace owner can delete all workspace data from the Retention page inside the product. Deletion hides the data immediately, stops workspace processing, and schedules removal from active storage within 7 days. A deletion receipt records counts and digests, never uploaded contents. Minimal account and authorization records remain.
- There is no self-serve delete for a single recording or upload yet. To delete one, or if the Retention page does not work for you, email team@fastcrest.com from an address on your account.
- Backup copies of uploaded files and outputs are deleted automatically no more than 30 days after they are made, so a copy of deleted data can stay in backup for up to 30 days. Database backups are not yet covered by that 30-day limit.
- Deleting data in FastCrest Cupel does not reach copies already sent to a model provider for a job. Those are handled under that provider's own retention terms.
Logging
Our application logs record event names, counts, sizes, timings, statuses and internal identifiers. The logging code refuses email addresses, web addresses, credentials and free text, and never logs file contents. These logs are sent to Honeycomb. The hosting platform also keeps standard request and server logs, such as IP address, requested path and status. The in-app assistant logs its safety-check outcomes and token counts, not message text; the conversation itself is stored in your workspace.
Things we do not have yet
- No independent security audit or certification, such as SOC 2 or ISO 27001, and no independent penetration test.
- No customer-managed encryption keys.
Reporting a security issue
Email team@fastcrest.com with "Security" in the subject line. Please do not include customer data in the report.