Security & trust

An honest trust posture, not a badge wall

Security pages usually tell you what a vendor wants you to believe. This one tells you what is actually built in, and what we deliberately do not claim yet.

What is built in

Tenant isolation

Each organisation's videos, drafts, releases, training records and billing context are separated per tenant. Cross-tenant access is a design invariant, enforced in the data layer, not a configuration option.

Human approval over AI

AI operates in proposal mode: it drafts procedure steps, warnings and checklist items from task videos. A named manager must review and approve before anything reaches workers. There is no autonomous approval, publishing or billing path.

Publication controls

Approval creates an immutable version; training, quizzes and checklists bind to that version. What a worker trained on can always be traced to the exact approved release and its approver.

Safe media handling

Task videos are access-controlled within the tenant. Worker-facing public links are token-scoped and served with hardened headers (no indexing, no referrers, strict content-security policy, never framed).

Demo data safety

Public demos run on a synthetic demo tenant through a Docker-based demo lane. No real customer data is used in public demos, and we ask prospects not to share confidential data during evaluation.

What we don't claim

  • We are not SOC 2, ISO 27001 or HIPAA certified today, and we won't imply otherwise with badge walls.
  • We do not claim named customers, partners or testimonials that don't exist.
  • We do not claim the platform is hyperscale-production-proven; we are building deliberately toward that with design partners.
  • AI output can be wrong — that is exactly why every AI draft passes through manager review before workers see it.

Where this is heading: SOPCam Sentinel

SOPCam Sentinel is our roadmap for continuous assurance: automated, ongoing verification of the security and governance invariants described above, with evidence generated as a by-product of normal operation. It is a roadmap commitment — a direction we are building toward with design partners — and not a current certification or audit result.