SECURITY

The work in your studio is yours alone.

Crew Studio is built for solopreneurs whose voice, drafts, and strategy are core IP. Here's how we treat them.

Your data stays yours

Studios, briefs, memory, Studio DNA — all encrypted at rest in EU-hosted Supabase. Decryption keys live in Vercel KV, rotated quarterly. We don't share any of it with anyone, including Anthropic for model training.

No training on your data

All Claude API calls are made with the no-training flag enabled. Anthropic processes your briefs to generate responses, but never stores them for model improvement. Same for ElevenLabs (voice) and Replicate (avatars).

EU hosting

Supabase EU region for the database. Vercel EU edge for the web layer. Your data physically stays in the European Union under RGPD jurisdiction.

Audit trail by default

Every action taken by a specialist is logged. Every Round Table convened, every brief processed, every integration call. You can replay your studio's history. We can replay it if you ever ask for forensic clarity.

Delete means delete

Export everything as JSON at any time. Delete a studio — its DNA, crew, memory, and integrations are wiped from the live DB within the hour and from backups within 30 days. We don't keep ghost copies.

Open about our stack

We use Claude (Anthropic), ElevenLabs, FLUX via Replicate, Supabase EU, Vercel EU, PostHog EU for analytics, Stripe for billing, Resend for transactional email, and abstracted integration providers. No undisclosed sub-processors. Full list available on request.

Questions about how we handle your data? Email security@crew.studio.
A real human reads every message.