Security
Customer video is confidential by default. These are the controls behind that statement, written plainly.
All video and derived data is stored in the EU. Processing runs in Stockholm and Frankfurt; nothing is replicated outside the EEA.
TLS 1.2+ in transit, AES-256 at rest for object storage, and encrypted backups with separate key management.
Per-club isolation, role-based permissions, SAML SSO for league deployments and mandatory MFA for staff accounts.
Every export and download is logged with user, clip, timestamp and address. Logs are retained for twelve months and available to club administrators.
Object storage is replicated within the region. Metadata is backed up hourly with a 35-day point-in-time window, and restores are tested quarterly.
Customers are notified within 24 hours of a confirmed incident affecting their data. Post-mortems are shared with affected clubs.
We welcome reports from researchers. Write to security@arrogant-wood.work.gd with a description and, if possible, a reproduction. We acknowledge within two business days and we do not pursue legal action against good-faith research.
The same information is published at /.well-known/security.txt.
We use EU-based object storage, a European CDN and a transactional email provider. The current list, including regions, is available under NDA.
We answer vendor security questionnaires and can share our DPA on request.