Practical controls, stated precisely.
The current ReelReady repository includes real access-control and storage protections. We describe what exists rather than displaying compliance badges the product has not earned.
Authenticated generation
Paid media-generation API routes require an authenticated user and verify ownership of the relevant project or scene before submitting provider work.
Private media
Source-media and export storage is configured as private. Signed URLs are used when private assets need temporary browser access.
Database isolation
The supplied Supabase schema uses row-level security for core user-owned records. Server-side service credentials are not intended for exposure in browser code.
No borrowed trust marks
ReelReady should not display ISO, SOC 2, Cyber Essentials or similar assurance logos until those certifications or assessments have actually been completed and their trademark requirements allow display.