FilmSpark is built for professional productions. This page explains how we protect your content, which partners process it, and how to request our security documentation.
Our commitments
No training on your content
We never use your inputs, prompts or outputs to train, fine-tune, evaluate or improve any AI model. Every model provider in FilmSpark is contractually bound by the same rule.
You own your work
You own everything you generate, and it is yours to use, license and distribute.
US hosting
Your content is stored in the United States. Some generation models process content outside the US; enterprise projects can be restricted to US-only models.
Deletion on request
Content is removed from live storage within 48 hours of a written request and purged from backups within 30 days, with written certification on request for enterprise customers.
How we protect your content
- Encryption: TLS 1.2 or higher in transit and AES-256 at rest.
- Workspace isolation: content is separated by workspace and every request is authorized against the user's session and workspace.
- Access control: least-privilege, need-to-know access, unique credentials, and multi-factor authentication for administrative access.
- Roles: team workspaces with Owner, Admin, Member and Viewer roles.
- Logging and incident response: access and administrative activity is logged, and we maintain a documented incident response process.
- Vendor diligence: we review each provider's security before engaging them and periodically afterwards, and bind them to data protection terms.
- No data centers of our own: physical security is provided by our hosting and infrastructure providers.
Certifications
FilmSpark does not currently hold its own SOC 2 or ISO 27001 certification. Several of the infrastructure partners that store and process your content hold their own independent attestations, listed below. Each certification belongs to that provider, not to FilmSpark.
Partners and subprocessors
Providers that process your content
| Provider | Purpose | Location | Provider's security status |
|---|---|---|---|
| fal | Primary AI model inference and compute | United States | SOC 2 · Trust center |
| Supabase | Database and file storage (US-East) | United States | SOC 2 Type 2 · Details |
| Amazon Web Services | Application hosting, content delivery, temporary processing storage | United States | AWS compliance programs |
| OpenAI | Story and prompt processing, AI assistant features | United States | Trust portal |
| Anthropic | Story and prompt processing, AI assistant features | United States | Trust center |
| Story and prompt processing, AI assistant features (Gemini API) | United States | Google Cloud compliance | |
| Beeble | AI relighting and compositing | United States and Korea | SOC 2 Type II in progress (per Beeble) · Details |
| World Labs | 3D world and spatial generation | United States, with international service providers | World Labs |
Most generation models in FilmSpark are reached through fal. The model used for each generation is shown in the product.
Providers that process account information only
| Provider | Purpose | Location | Provider's security status |
|---|---|---|---|
| Clerk | Authentication and account management | United States | SOC 2 Type 2 · Trust center |
| Stripe | Payment processing | United States | Security at Stripe |
| PostHog | Product analytics and error reporting | United States | SOC 2 Type 2 · Trust center |
| Sentry | Error and performance monitoring | United States | SOC 2 Type 2, ISO 27001 · Trust center |
| MailerLite | Mailing list and transactional account email | United States | See provider |
| Google Analytics / Tag Manager | Website and product analytics (in your browser) | United States | Google compliance |
| Termly | Cookie consent (in your browser) | United States | See provider |
Full details, including onward subprocessors, are on our Subprocessors page. Enterprise customers receive advance notice of changes under their Data Processing Addendum.
Documents available on request
Under NDA for customers and prospective customers:
- Security overview
- Data Processing Addendum
- Information security policy set
- Model Clearing Standard
- Completed security questionnaires
Report a security issue
If you believe you've found a vulnerability or security issue, email legal@filmspark.ai with "Security issue" in the subject. Please don't publicly disclose the issue until we've had a chance to respond.
Last updated: November 2, 2026
Let’s talk Enterprise
Our team is here to help with advanced capabilities tailored for studios and brands like yours. If you want to learn more about our Enterprise offering, please fill out the form.
