Security and compliance: what’s actually in place
Updated October 8, 2026
Why this comes up
Recruiting, HR, and marketing teams at larger organisations are often required to clear any new tool through IT or legal before using it — particularly one that touches video of real people. This article covers the points that usually come up in that review.
Data handling
Encryption in transit and at rest, dashboard access limited to the account that owns the campaign, and no use of customer data to train machine-learning models — see How we protect submitted videos for the full breakdown.
Subprocessors and data processing terms
A current, named list of every subprocessor that touches customer data is published at /legal/subprocessors, and the Data Processing Agreement at /legal/dpa applies when you use the service, with no signature needed; that page says how to request a countersigned copy. Both are documents a procurement or legal review will typically ask for.
Questions a standard review doesn’t cover
If your organisation’s review process needs something beyond what’s published, such as a specific security certification, a custom DPA clause or a call with your security team, contact us directly and tell us what your review needs.
Was this article helpful?