Security

ChannelForge publishes as you on the platforms you connect, so it holds things worth protecting: your sign-in, your platform accounts' tokens, your channels and their videos, your credits. This page says how each is protected, what you can do yourself, and how to report a vulnerability. The security page is the short version.

Accounts and sign-in#

• Passwords are hashed with argon2id at the parameters OWASP recommends; the password itself is never stored.
• Two-factor authentication with any authenticator app (TOTP): a code is accepted once only, and ten single-use recovery codes are shown when you turn it on, then kept only as hashes.
• Sessions live on the server. The cookie carries a random token with a signature, and is HttpOnly, Secure and SameSite=Lax; the database keeps only a hash of the token, so a copy of it could not be replayed as a login. A session is replaced at every sign-in and ended when the password changes.
• Throttling. Sign-in, sign-up and the second factor are rate limited per address and per account. After ten failed sign-ins an account is locked for 15 minutes — a lock kept in the database, so it holds even if the cache is lost. Password resets never reveal whether an address has an account.
• Every change in the app is protected against cross-site requests: a token and an Origin check on every form.

Workspaces, roles and staff#

• One workspace at a time. Every page and action works out the workspace from the request, requires a membership — a person who is not a member gets "not found" — and checks the member's role: owner, admin, editor or viewer. Every query names the workspace. Projects can be limited to teams.
• Keys and connected apps. API keys act for one workspace with the scopes they were given, are stored as hashes, expire if you choose, and are rate limited. An assistant connected over OAuth acts for one workspace, with what its person allowed; only owners and admins connect apps, and a connection ends when its person stops being one.
• The audit log records security, membership, billing and administrative actions, including those made with an API key or by a connected app. Download my data in your account settings includes your own audit trail.
• ChannelForge's staff reach workspaces only through the admin console. Support staff can look and change nothing; administrators' changes are recorded in the audit log.

Connected platform accounts#

• You connect each account through the platform's own sign-in (OAuth); ChannelForge asks only for the permissions publishing and reading need, and never sees your platform password.
• Tokens are sealed with AES-256-GCM the moment they arrive, under a key that exists only on ChannelForge's servers. They are opened only by the job that posts or reads for that account, and never appear in an API answer, a webhook, a log or an email.
• Disconnect deletes ChannelForge's copy of the tokens at once; revoking the grant at the platform itself is in the platform's own settings. A deleted workspace's tokens are deleted within 7 days.

The site and the app#

• TLS end to end: from your browser to Cloudflare, and from Cloudflare to the servers with an origin certificate. The servers accept web traffic only from Cloudflare's network, and HSTS keeps browsers on HTTPS.
• Strict browser policies: every signed-in page sends a Content Security Policy with a fresh nonce on each request, refuses to be framed by another site, and isolates itself from other windows; the public pages carry no user data.
• Rate limits on sign-in, sign-up, the API, the MCP server and the free tools; the free tools also ask the browser for a small proof of work.
• Outgoing calls cannot be turned inwards. Webhooks go to public HTTPS addresses only, checked when they are added and again at every delivery, connected to the address that was checked, and never redirected — so an address you enter cannot point ChannelForge at its own internal services.

Secrets#

• The application server holds no AWS key: it uses its own cloud role, limited to its storage bucket, its email identity and starting and stopping its own GPU machines. Google Cloud's credential is limited to what the GPU fleet and the speech services need.
• The model credential is readable only by the model gateway. No credential of any kind is ever placed on a GPU machine.
• Payment keys are kept in one protected place on the server; payments themselves are made on Stripe's and PayPal's own pages.
• No secret is kept in the code repositories, which are scanned for secrets every night.

Generation jobs#

Episodes are written by an agent that writes and runs code, on GPU machines shared between workspaces. The machines are given as little as possible:

• no cloud, model or platform credential, and no cloud service account; remote sessions are accepted only from ChannelForge's control plane;
• each job runs as its own user, in a folder only it can enter, in its own process and mount namespaces, with private temporary files;
• while it runs code an agent wrote, the job has no internet access and no name lookups — only its own encrypted tunnels to the model gateway and the voice service;
• its tokens name the workspace, the job and the attempt, cap what it may spend, expire, and stop working as soon as the job is no longer running;
• no value a tenant influences is ever run as a command on the machine, and the job's home, temporary files and processes are wiped before and after.

Narration is protected the same way: a job's narration token names its narrator and language and caps its characters; the voice service accepts only its allowed voices and bounded lines and settings; its cache is kept per workspace; and its log has counts, never the words or a token. The details are in The GPU fleet and isolation.

Data#

• The database is encrypted, on a private network, reached only by ChannelForge's own services — each of which verifies its certificate — with point-in-time recovery over 7 days and protection against deletion.
• Media lives in a private, encrypted bucket with public access blocked, handed to members only as signed links that expire within minutes.
• The service is hosted in the EU. What is kept where, and for how long, is in Data, storage and retention.

Payments#

Card and PayPal details are entered on Stripe's and PayPal's own pages and never reach ChannelForge's servers. ChannelForge receives a payment reference and limited details such as the type of payment method, never a full card number. Every purchase is made by a person completing a checkout.

Monitoring#

• The sentinel checks the whole system every minute and opens an incident for what it cannot fix: jobs or posts failing, the model credential refused, the narration service down, GPUs scarce. Serious incidents are emailed to the operators straight away.
• Security events — sign-ins, failed sign-ins, rate limits reached — are logged and kept for up to 12 months.
• The status page shows the state of the app, the queue and the GPU fleet, and open incidents.

What you can do#

• Turn on Two-factor authentication in Account & security, and keep your recovery codes somewhere safe.
• Check Where you’re signed in now and then; Sign out everywhere else ends every other session.
• Give each API key the fewest scopes and an expiry; revoke the ones you no longer use.
• Review Connected apps in Settings → API & webhooks, and revoke any you do not recognise.
• Give people the lowest role that lets them do their work, and limit sensitive projects to teams.
• Set monthly spending caps for the workspace and for its busiest channels.

Reporting a vulnerability#

If you believe you have found a security issue, write to support@storeswiki.com with the subject "Security report": what you found and the steps to reproduce it. Please test only against your own workspace, do not access or change data that is not yours, and give us a reasonable chance to fix the issue before you share it. We confirm that we received your report and keep you updated while we work on it. The same rules are on the security page.

Related#

• Privacy at a glance — what is collected and why.
• System overview — the parts these protections sit in.
• Your account and sign-in — two-factor, sessions, your data.
• Workspaces, projects, teams and roles — who may do what.