Security

Overview

Writers Room is a small, independently operated service. This page describes how we protect the data you entrust to us — plainly, and limited to what we actually do. For what data we collect and why, see the Privacy Policy.

Encryption in transit

All traffic to writersroom.studio — the website, the API, and media delivery — is served over HTTPS (TLS) through Cloudflare’s edge network. Connections between our application and our database and storage providers are likewise encrypted in transit.

Data at rest

Your account data, stories, and editorial notes live in a Supabase Postgres database, which encrypts data at rest. Generated episode files and audio are stored in Cloudflare R2, which also encrypts objects at rest. Private stories are only ever readable through your authenticated account.

Authentication

Sign-in is handled by Supabase Auth. Sessions are authorized with short-lived JSON Web Tokens signed with modern asymmetric cryptography (ES256), verified server-side on every request. We never see or store your password in our own database — credential handling stays inside Supabase Auth.

Payments

Payments and subscriptions are processed by Stripe. Card numbers are entered into Stripe-hosted fields and never touch our servers; we store only opaque Stripe references (customer and payment-method identifiers) and coarse metadata such as card brand and expiry.

Subprocessors

We rely on a small set of infrastructure providers, each receiving only the data needed for its role:

• Supabase — authentication and database hosting.
• Cloudflare — application hosting, storage (R2), and content delivery.
• Stripe — payments and subscriptions.
• Anthropic, OpenAI, Google, ElevenLabs — AI model providers for story text and audio generation.
• Resend — transactional email delivery.
• Langfuse — generation tracing and quality observability.

Operational practices

• API keys and credentials are stored as encrypted Cloudflare Worker secrets — never in source code or client-side bundles.
• Administrative surfaces are restricted to a short allow-list of accounts and enforced server-side on every request.
• Deployments are automated from version-controlled source, so what runs in production is what was reviewed and committed.

Responsible disclosure

If you believe you’ve found a security vulnerability in Writers Room, please tell us through the contact page with enough detail to reproduce the issue. We don’t run a bug bounty program, but reports are genuinely appreciated, acknowledged, and acted on. Please don’t access other users’ data or disrupt the service while investigating.

Honest limits

We are a small operation and don’t currently hold formal certifications such as SOC 2 or ISO 27001. What we promise instead is a deliberately small attack surface, reputable managed infrastructure, and prompt attention to anything you report.