Identity
Who you are, proved more than once where it matters.
- Two-factor and recovery codes
- Authenticator-app codes, with recovery codes stored only as hashes. Sensitive actions — invites, contracts, share links, sending an invoice, changing permissions — ask for the second factor again.
- Passkeys
- Sign in with a passkey instead of a password.
- Single sign-on
- SAML and OIDC, with the domain proved by DNS first and enforcement available.
- SCIM 2.0
- Provisioning from your identity provider; deactivation signs the person out everywhere.
- The studio’s own rules
- Required two-factor, a maximum session age and an idle timeout, set by the studio.
- Delegation limits
- Nobody can grant a permission they do not hold. The database enforces it.
Application protections
What stands between the internet and the product.
- Rate limiting in the database
- One limiter shared by every server instance. On the routes that need no session, a limiter failure refuses the request rather than letting it through.
- Security headers and a per-request content security policy
- A content security policy built for every response with a fresh nonce — in report-only mode today while violations are reviewed — plus strict transport security, no framing, and camera and microphone granted to the product’s own origin only.
- Bot protection and breached passwords
- A challenge on sign-up and sign-in, a disposable-address list, and a check of every new password against known breaches. Passwords are at least 15 characters, with no composition rules, as NIST SP 800-63B asks.
Data
Where it lives, how long it stays, and how it leaves.
- One US region
- Everything is hosted in the United States, in one region. There is no other region today.
- Retention
- Deleted rows wait out a grace window before they are purged. The activity ledger is kept for seven years and cannot be deleted inside that window, even by a cascade.
- Erasure
- A person can be erased, with a stable pseudonym left in their place so the record still reads.
- Orphaned objects
- Files left behind by an abandoned upload are found and removed.
Content
The cut, the contract and the person watching.
- Session watermarking on screening links
- The viewer’s own identity moves across the frame. It is aimed at screen recording, and it is not forensic watermarking.
- Single-use signing links
- A signing link works once. Its token is never stored, only its fingerprint.
- Sealed contracts
- A signed contract is sealed with a cryptographic signature, with the certificate of completion inside the file.
What we have not done yet
Each of these has its plan on the roadmap.
- No SOC 2 report
- Genreline does not hold a SOC 2 report.
- No ISO 27001 certification
- Genreline is not ISO 27001 certified.
- No TPN assessment
- Genreline has no MPA Trusted Partner Network assessment. A TPN Blue Shield self-attestation is the first step on the roadmap.
- One region
- There is no data residency outside the one US region.
- No organization-wide audit export
- Approval certificates can be printed; there is no export of the whole activity ledger yet.
- No forensic watermarking
- Screening links carry a session watermark only.
