SECURITY
The work in your studio is yours alone.
Crew Studio is built for solopreneurs whose voice, drafts, and strategy are core IP. Here's how we treat them.
Encryption
Studios, briefs, memory, Studio DNA are all encrypted at rest in EU-hosted Supabase. Decryption keys live in Vercel KV, rotated quarterly. We don't share any of it with anyone, including Anthropic for model training.
We never train on your data
All Claude API calls are made with the no-training flag enabled. Anthropic processes your briefs to generate responses, but never stores them for model improvement. Same for ElevenLabs (voice) and Replicate (avatars).
GDPR and EU hosting
Supabase EU region for the database. Vercel EU edge for the web layer. Your data physically stays in the European Union under RGPD jurisdiction.
Audit trails, on by default
Every action taken by a specialist is logged. Every Round Table convened, every brief processed, every integration call. You can replay your studio's history. We can replay it if you ever ask for forensic clarity.
Exports and deletion
Export everything as JSON at any time. Delete a studio. Its DNA, crew, memory, and integrations are wiped from the live DB within the hour and from backups within 30 days. We don't keep ghost copies.
Open about our stack
We use Claude (Anthropic), ElevenLabs, FLUX via Replicate, Supabase EU, Vercel EU, PostHog EU for analytics, Stripe for billing, Resend for transactional email, and abstracted integration providers. No undisclosed sub-processors. Full list available on request.
What we don't do yet
Crew Studio holds no SOC 2 and no ISO 27001 certification today, and offers neither SSO nor SAML. The full sub-processor list is sent on request rather than published. If your procurement process requires any of those, wait for us instead of working around it.
Questions about how we handle your data? Email security@crewstudio.ai.
A real human reads every message.
Questions from buyers
What procurement usually asks.
Does Crew Studio train on my data?
No. Crew Studio never trains any model on operator data. Studio DNA, prior briefs and generated work stay inside the Studio that produced them. This applies to both plans and is not conditional on a setting.
Where is my data hosted?
Crew Studio hosts operator data in the European Union and operates under GDPR. Data location is not a paid option or an enterprise tier feature. It applies to every account on both plans.
Who owns the work the crew produces?
The operator owns it. Crew Studio claims no rights over briefs, Studio DNA, generated drafts or any output. Everything exports in one click, in open formats, at any time and without asking support.
Can I delete everything?
Yes. Crew Studio deletes an account and its Studios in one click, including Studio DNA and stored briefs. Deletion is not queued behind a support ticket, and export remains available up to the moment of deletion.
Who are your sub-processors?
Anthropic for Claude, ElevenLabs for voice, Replicate for image generation, Supabase in the EU for the database and storage, Vercel in the EU for hosting, PostHog in the EU for product analytics, Stripe for billing, and Resend for transactional email. There are no undisclosed sub-processors. The full list with each role and region is sent on request, and it is not published yet, which is one of the gaps named above.