Security at Framesite

Maestro Media, operator of Framesite (the "Service"). Updated July 13, 2026.

Your videos, your brand's memory, and your connected accounts are the business. Here is how we protect them, in plain language.

Encryption

• In transit: all traffic to and from the Service uses HTTPS with TLS 1.2 or above, including every call to a connected service and every file download.
• At rest: data is stored on managed infrastructure (Supabase and its underlying cloud) with encryption at rest. Credentials for connected services are additionally stored in an encrypted secrets vault, separate from ordinary application data.

Tenant isolation

Every workspace is its own tenant. Every read and write in the Service is scoped to your company, enforced in the application's data layer, so one customer's content, memory, and connections are never visible to another. Agency workspaces see only the client workspaces they own.

Connected accounts

• Every connection uses the provider's own OAuth consent screen; we never see or store your password for another service.
• We request the narrowest scopes the feature needs, usually read-only.
• Tokens live in the encrypted vault, are used only on our servers, and are never sent to the browser.
• Only workspace admins can connect or disconnect a service, and disconnecting stops access.

Application safeguards

• Role-based access: settings, connections, publishing, and spending are gated by workspace roles.
• Outbound requests to customer-provided addresses are validated against private networks (SSRF protection), including every redirect hop.
• Background work runs in isolated worker services, separate from the web application.
• Spending is metered with per-workspace budgets, and significant work shows its cost before it runs.
• Actions on your account, including every connector read and every generation, are recorded in an audit log.

Development practices

Changes go through code review before deploy, and we run recurring security audits across the platform's surfaces, including its connectors, publishing pipeline, and memory system, fixing what they find before building new features on top.

Payments

Billing runs through Stripe. Card details go directly to Stripe; we never see or store your full card number.

Reporting a vulnerability

If you believe you have found a security issue, email help@framesite.ai with enough detail to reproduce it. We will acknowledge your report, work on a fix, and keep you informed. Please do not access other customers' data or disrupt the Service while researching.