Data Security & Encryption

Last updated: May 31, 2026

Your data is encrypted at every stage — moving across the internet, sitting in our database, and inside every backup. This page explains, in plain terms, exactly how we keep your account and your artists' data protected.

In transit

Every connection is secured with TLS (HTTPS). Nothing travels over the network in the clear.

At rest

All stored data, files, and backups are encrypted on disk with AES‑256, the same standard banks use.

Isolated

Row‑level security keeps every company's data walled off — you only ever see your own.

1. Encryption in Transit

Whenever data moves between your browser and Label Suite, or between Label Suite and our database, it is protected with Transport Layer Security (TLS 1.2+), the same technology that secures online banking. This means anyone intercepting the connection — on public Wi‑Fi, for example — sees only scrambled data, never your content, credentials, or analytics.

2. Encryption at Rest

Once your data reaches us, it is stored on disks encrypted with the AES‑256 standard. This applies to:

  • Your account database (profiles, artists, analytics, scheduled posts)
  • Uploaded media — audio, images, and video files in our storage
  • All automated backups

If a physical drive or a backup file were ever lost or stolen, the contents would be unreadable without the encryption keys, which are managed separately and never stored alongside the data.

3. Account Isolation (Row‑Level Security)

Encryption protects data from outsiders; isolation protects it from other customers. Label Suite enforces Row‑Level Security at the database layer, so every request is automatically scoped to your company. There is no way for one customer to read, modify, or even detect another customer's data — the database itself refuses the access, independent of any application code.

4. Access & Credentials

We minimise who and what can touch your data:

  • Passwords are never stored in plain text — authentication is handled by our identity provider using salted, hashed credentials.
  • Connections to third‑party platforms (such as TikTok) use OAuth tokens scoped to only the permissions you grant, and can be revoked at any time.
  • Administrative access to production systems is restricted and protected by strong authentication.

5. Infrastructure & Subprocessors

Label Suite runs on established cloud infrastructure providers whose data centres carry industry security certifications. These providers maintain the encryption guarantees described above, and we require any subprocessor that handles user data to uphold equivalent protections in line with applicable data‑protection laws.

6. Ongoing Improvements

Security is never finished. We continue to invest in additional safeguards — including field‑level encryption for the most sensitive data — and will update this page as those protections roll out. If your organisation has specific compliance requirements, we're happy to discuss them.

7. Questions or Reports

For security questions, or to report a vulnerability, contact us at reycoleman4@gmail.com. We take every report seriously and will respond promptly.

LabelSuite — Music Tools