Security

Last updated: October 21, 2026

This page summarises how Plugin Play LLC (doing business as Brevidy) protects the data you process with Brevidy. It applies to the Brevidy extension for Adobe Premiere Pro, the web dashboard and API at www.brevidy.pro, and the cloud processing behind them. For our contractual commitments, see the Data Processing Addendum.

Hosting and Data Location

  • Customer data is stored in the United States: the database, authentication and file storage run on Supabase, hosted on Amazon Web Services in us-west-1 (Northern California).
  • The web application and API run on Vercel in the United States.
  • We do not operate our own servers or data centres. Our infrastructure providers hold independent certifications such as SOC 2 Type II and ISO/IEC 27001; those certifications are theirs, not ours.

Encryption

  • In transit: all connections between the extension, browsers, our API, our database and storage, and our subprocessors use TLS 1.2 or higher. Our API sends an HTTP Strict-Transport-Security (HSTS) header, so browsers connect only over HTTPS.
  • At rest: the database, file storage and backups are encrypted at rest by our infrastructure provider (AES-256).
  • Payments: card data is handled only by Stripe. We never receive or store full card numbers.

Access Control and Separation

  • Row-level separation. Every record carries its owning user and, for teams, organisation. PostgreSQL row-level security enforces this in the database itself, so each user can reach only their own records and their organisation's records, according to their role.
  • Private storage. Uploaded files are kept in private storage. Processing providers receive a signed link that expires after 30 minutes, never a public URL.
  • Least-privilege staff access. Access to production systems and customer data is limited to the few people who need it to run and support the Service. Staff use named personal accounts with two-factor authentication, and access is removed and credentials rotated when someone leaves.
  • Server-side secrets. Database and provider keys are held only in our hosting provider's encrypted configuration and are never shipped to the browser or the extension.

How We Process Your Content

  • Job-scoped processing. For captioning and transcription, the extension extracts audio on your computer and uploads only that audio. Video is uploaded only for AutoCrop, as a rendered proxy. Optional speaker separation runs entirely on your computer.
  • Only what each provider needs. Each subprocessor receives only the data its function requires, and only when you use that feature. For example, transcription providers receive audio, never video or account data.
  • No training on your content. We do not use your media, transcripts, captions or other content, or the outputs generated from it, to train AI models or to develop or improve our Services, and we do not allow our AI and transcription providers to train on it.

Retention and Deletion

  • Optional zero data retention. Team administrators and individual users can turn on zero data retention in the dashboard. While it is on, uploaded media, transcripts, captions and AI inputs and outputs for each job are deleted within 60 minutes after the job finishes, and in any event within 24 hours, including for jobs that fail or are cancelled. Job metadata needed for billing and support (type, duration, minutes used, timestamps) is kept.
  • Standard retention. Without zero data retention, job content is kept with your account so jobs can be reviewed, re-run and supported, until you ask us to delete it or your contract ends. See Section 12 of the Data Processing Addendum.
  • Your projects stay yours. Captions, transcripts and edits written into your Premiere Pro project stay on your own systems.

Availability and Backups

  • The database is backed up daily, and backups are kept for seven days on a rolling basis.
  • We run on managed cloud infrastructure with our providers' redundancy and DDoS protection, and can roll back the application to a previous release within minutes.
  • Three transcription providers are integrated, so transcription can move to another provider if one is unavailable. Stalled jobs are detected automatically so they can be retried, and failed jobs are not billed.

Incident Response

  • We monitor errors and provider alerts continuously.
  • If a security incident affects your personal data, we will notify you without undue delay and within 72 hours of becoming aware of it, with the information you need to meet your own obligations, as set out in Section 8 of the Data Processing Addendum.
  • To report a suspected security issue, email admin@pluginplay.app.

Subprocessors

We select subprocessors for their security posture and bind each one by data processing terms with confidentiality and security obligations, plus the EU Standard Contractual Clauses or EU-U.S. Data Privacy Framework certification for transfers outside the EEA. The current list, with what each provider does and receives, is on our Subprocessors page. We give at least 14 days' notice by email before adding or replacing a subprocessor.

Full TOMs Document

Our full Technical and Organisational Measures (TOMs) document is available to customers on request at admin@pluginplay.app.