Security and subprocessors
How Tech Digital Group LLC protects customer content in LocaleFrame, and which providers process data on our behalf.
- Encryption
- TLS 1.2+ in transit. AES-256 at rest in S3, RDS and Object Storage, with a separate AWS KMS key for each customer workspace.
- Access
- Staff access requires SSO with multi-factor authentication. Production access is limited to the engineers who operate it, through short-lived credentials.
- Workspace isolation
- Row-level security per workspace, scoped presigned URLs and isolated render jobs. Glossaries and voice references never leave the workspace they belong to.
- Delivery
- Compute runs in private subnets. Embedded campaigns use signed, expiring HLS URLs, with rate limiting at the edge.
- Logging
- API and admin actions are written to a central audit log and kept for 90 days.
- AI providers
- We use commercial API terms only. Customer content and outputs are not used to train our models or our providers' models.
- Certifications
- We have not completed a SOC 2 audit yet. Enterprise customers can request our security questionnaire answers and Data Processing Addendum from founder@localeframe.com.
Subprocessors
Tech Digital Group LLC is the data controller for account and website data and a processor for customer content. We give customers at least 30 days' notice before adding a subprocessor.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services, Inc.AWS (ECS, SQS, RDS, S3, KMS) | Application hosting, job orchestration, campaign database, encrypted asset storage | Account data, product URLs and assets, campaign metadata, generated outputs | United States |
| Google LLCGoogle Cloud (Vertex AI, BigQuery) | Frame-level retention scoring, saliency analysis and aggregate performance telemetry | Rendered video frames, campaign identifiers, aggregated scores | United States |
| Anthropic, PBCClaude API | Product page analysis, brand-voice extraction, script transcreation and cultural adaptation | Product page content, brand glossaries, script drafts | United States |
| Runway AI, Inc.Runway API (Gen-4.5, Act-One) | Generative motion synthesis and presenter lip-sync | Product keyframes, camera prompts, voice tracks for lip-sync | United States |
| Akamai Technologies, Inc.Akamai Connected Cloud (Linode compute, Object Storage, Edge CDN) | GPU transcoding and muxing, video origin storage, global edge delivery | Rendered video files, subtitle tracks, HLS manifests, viewer request logs | United States; edge caches worldwide |
| Vercel Inc.Vercel | Hosting of the marketing website and public sandbox | Website request logs, contact form submissions | United States |
Incidents
If an incident affects customer data, we tell affected customers without undue delay, and within 72 hours of confirming it, then keep them updated until it is resolved.
Backups
Production databases have automated daily backups with point-in-time recovery. Render artifacts can be rebuilt from their stored inputs, so a failed job resumes without losing work.
Reporting a vulnerability
Email support@localeframe.com with “Security” in the subject. Please give us reasonable time to investigate before disclosing. We won't take legal action over good-faith research that respects user privacy and avoids disrupting the service.