Security

Where the data lives

• Database and files: Supabase, in Ireland (European Union).
• Website and application servers: Vercel, processing in Frankfurt (European Union).
• Media server (video, audio, recordings, replays): Hetzner, in Finland (European Union).

The full list of providers is in the Privacy Policy.

Encryption

• All connections are encrypted (HTTPS/TLS), including those from cameras and phones in the live applications.
• The database is encrypted at rest.
• Stream keys (RTMP/SRT) and passphrases are stored encrypted (AES-256-GCM) and never sent back to the browser.
• The most sensitive data (application data, events, artists, fees, accommodation, contacts, document text and booking requests) is encrypted field by field (AES-256-GCM) before it reaches the database, with a key that only exists on the server.

Each account only sees its own data

• Security rules in the database itself stop one account from reading or changing another’s data.
• On the media server, each broadcast and each cloud production only accepts requests from the account that created it.
• Live rooms (HubProd Live, teleprompter, graphics) use private channels: only someone who receives a temporary key from our server for that room can join.
• Share links open isolated from the session of whoever opens them, and you can revoke them at any time.
• Applications run on their own address (apps.hubprod.com), separate from the website, the account pages and administration.

Account access

• There are no passwords: you sign in with a one-time code sent to your email.
• You can turn on two-step verification (a code from an authenticator app) on the "My account" page.
• You can sign out of every device at once.
• Administration access always requires two-step verification, and sensitive actions are logged.

Your data is yours

• Download: on "My account" you can download a copy of all your data (JSON).
• Delete: you can delete your account. We also delete files, recordings, clips and replays on the media server, and share links.
• Automatic clean-up: old statistics and logs are deleted every day, within the periods stated in the Privacy Policy.
• We do not sell data, do not run advertising and do not use analytics or advertising cookies.

How we work

• Every change to the website goes through automated tests before it is published.
• Servers receive security updates and only accept administration access with an SSH key.
• We have an incident response plan. If a data breach affects you, we will inform you and the Portuguese authority (CNPD) within the legal deadlines.
• The live state of our services is shown on the "Service status" page.

Still in progress

hubprod is in beta and we prefer to be clear about what we are still improving:

• legal review of the terms and privacy policy, and a data processing agreement (DPA) for companies;
• an external security audit.

Found a problem?

If you find a security issue, tell us through the contact form on the home page, choosing the area "Security". We are grateful and will reply as soon as possible. Please do not access other people’s data or disrupt the service.