/security · how your work is protected
A studio’s files are its clients’ trust made concrete: rough cuts, contracts, invoices, unreleased work. Here is exactly how that is kept safe, in claims you can hold us to, not badges.
said plainly
Gaurify OS does not hold a SOC 2 or ISO 27001 certificate today, and we will not imply one with a logo. We are a studio’s software built by a studio. What we can show you is the machinery below, all of it running now.
Every studio, and every client inside it, is walled off from the rest. There is no screen, link or export that crosses the wall.
howEnforced in the database with row-level security, not only in the app. A bug in a page cannot leak a row it was never allowed to read.
Clients only ever see your studio, never who did the work. You control who on your team sees the client and who sees only the work, so nothing leaks that you did not intend.
howThe identities are separated server-side on every request, so the isolation does not depend on the interface hiding a name.
What a person can do is decided by the server on every action, never by the screen they are looking at.
howOne authorisation engine (can / assertCan) runs before every protected request. The frontend is treated as untrusted by design.
Your data is encrypted in transit and at rest, on managed Postgres infrastructure that a small studio could not run to the same standard alone.
howHTTPS is forced with HSTS preload, so a new visitor's very first request is already secure. Clickjacking is off, MIME sniffing is off, and camera, microphone and location are denied by default.
Sign in with a one-tap magic link, a 6-digit code, or a passkey, with two-factor. Sessions are scoped to one host, so a token cannot be replayed across the marketing site and the app.
howPasswordless by default: a magic link or a passkey means there is no password to phish, and two-factor is available on any account.
Connect your own Google Drive and deliverables live inside it. The work is yours, in a place you already control, even if you leave.
howThe Drive connection is the studio's, revocable by the studio at any time from Google's own settings.
leaving is a feature, not a fight
You can cancel from inside the app, with no email to write and no retention call to sit through. If you stop, your work is kept for 12 months so a change of mind is never a loss. Data you kept in your own Drive was always yours and stays exactly where it is.
Found something, or have a question your compliance team needs answered? Write to hello@gaurifyhq.com and a person, not a ticket bot, will reply.