Security & data
Crew rates, home addresses and insurance papers. We treat them that way.
This page explains how BacklotHub actually handles your data, including what we don’t claim. If your team has a security questionnaire, send it over and we’ll answer it straight.
How it works
Built on Google Firebase
Records are stored in Firestore, files in Cloud Storage, and server-side work runs in Cloud Functions. Google encrypts data in transit and at rest. Firestore security rules decide who can read what, and they have their own automated tests.
App Check on the database and public forms
Firebase App Check is enforced on the database and file storage, and on the public sign-up, shipping, hire and RSVP endpoints. Requests that don’t come from the real BacklotHub web app are turned away.
Four roles, one access matrix
Super Admin, Admin, Manager and Employee. Rates and pay are visible to Managers and above. A Super Admin can switch off individual screens for a role. That editor can only take access away. New access is only ever granted in reviewed code.
Crew and vendors see only their own record
Self-service logins never read your database directly. Our server returns a short, fixed list of fields and accepts changes to an even shorter list. Internal notes, ratings, rates and spend history are never sent.
Signed links instead of shared passwords
Payroll confirmations, RSVP links, shipping-label pages and festival invitations use signed, purpose-specific links, so one kind of link can’t open another. Public submissions are rate-limited.
Two people for money
Purchase orders are raised by one person and approved by another. Nobody can approve their own. Vendor insurance problems show on the PO before it is approved.
AI on the server, not in the browser
AI features call Anthropic’s Claude from our server. There is no AI key in the browser, requests are rate-limited, and imports are shown to you for review before anything is saved.
Audit log and email log
Admins can review an audit log of changes. Every system email is logged with its outcome, so you can check whether a vendor actually received something instead of guessing.
Your data is yours
- Your company owns its data. We don’t sell it or use it to advertise.
- Crew, vendor and guest lists export to CSV exactly as filtered on screen.
- Admins can take and restore backups from Settings.
- If you leave, we’ll give you a full export of your company’s records.
- Crew and vendors can ask to be removed from a link, without making an account. Removal is reviewed by a person on your team.
What we don’t claim
We’d rather you hear it here than find out in procurement. BacklotHub does not currently offer:
- SOC 2, ISO 27001 or any other certification. We don’t hold one.
- An uptime percentage or SLA.
- Single sign-on (SSO). It is on our roadmap for Enterprise and not available today.
- HIPAA or any other regulated-data compliance.
Security questions
Where is our data stored?
BacklotHub runs on Google Firebase: Firestore for records, Cloud Storage for files and Cloud Functions for server-side work. Google encrypts that data in transit and at rest.
Who at our company can see crew rates and personal details?
Access follows four roles: Super Admin, Admin, Manager and Employee. Rates are visible to Managers and above. An owner can also switch off individual screens for a role in a role-by-screen matrix. The matrix can only take access away, never grant more than the role already allows.
What can crew and vendors see when they sign in?
Only their own record, and only the fields on an approved list. Everything they read or change goes through our server, which checks every field. Your internal notes, ratings, rates and spend history are never sent to them, and they can’t see anyone else.
How are the public forms protected?
The sign-up, shipping, hire and RSVP pages use Firebase App Check to reject traffic that doesn’t come from our real web app, and public submissions are rate-limited. Links that act without a login, such as a payroll confirmation or a guest’s RSVP, are cryptographically signed. Each kind of link is signed separately, so one can never open another.
Does the AI see our data? Is our API key in the browser?
AI features run through our own server using Anthropic’s Claude. The browser never holds an AI key. Only the document or text you choose to import is sent, and imports show you the result to review before anything is saved.
Are you SOC 2 certified? Do you offer an uptime SLA?
No, and we won’t claim to be. We don’t hold SOC 2 or any other security certification today, and we don’t publish an uptime guarantee. We’ll answer your security questionnaire honestly and show you how access, audit logging and data handling actually work.
Can someone ask to be removed?
Yes. Crew and vendors can ask to be removed from a link, without making an account. A person on your team reviews each request. Records nothing depends on are deleted. Records tied to payments or productions have their contact details erased and are kept only for your financial history.
Have a security questionnaire?
Send it with your demo request. We’ll answer it honestly and show you each control working.