● Ship · Protecting the studio
Security
what Kinetica protects, and what is up to you.
How keys, passwords, links and webhooks are protected in the code, and the few things you must do yourself on the server.
01Built in
| What | How |
|---|---|
| Saved API keys | Encrypted with ADMIN_SECRET_KEY, write-only in the console (replace or test, never read back), changeable by owners only |
| Console sign-in | A one-time setup code for the first owner, two-factor sign-in, the option to require it for owners and managers, sessions you can see, and an audit log of every sign-in and change |
| Studio passwords | At least 10 characters; stored as hashes; changing one signs out other devices. "Forgot password" is rate-limited |
Studio API keys (msk_…) | Shown once, stored only as a hash, revocable, rate-limited per key, scoped to one workspace |
| Outgoing webhooks | https on port 443 only; local and private addresses refused; every delivery signed with HMAC-SHA256 and a timestamp |
| Stripe webhook | The signature is verified before anything is trusted; each event is recorded once |
| Share and review links | Random tokens; revocable; review links expire (30 days by default); comments rate-limited per address |
| Uploads | Checked by type and content, size limits per kind, a 2 GB quota per workspace |
| Framing | Same origin only by default (FRAME_ANCESTORS empty) |
| Docker | Runs as the unprivileged node user |
02Up to you
- Run behind https (Caddy) and keep port 8787 closed to the internet (Deployment).
- Set
TRUST_PROXY_HOPS=1behind one proxy, so rate limits see real visitor addresses. - Keep
.envreadable only by the service user, and never commit it anywhere. - Back up
ADMIN_SECRET_KEYseparately from the server. - Turn on two-factor for every console owner and manager.
- Keep backups off the server; a backup holds customer data (Backups).
- Update the operating system, Node.js and Chrome regularly, and install Kinetica updates (Updating).
- Never set
DEMO_MODE,DEMO_PASSWORDorADMIN_DEMO_PASSWORDon a server with real customers.
03Customer data
Everything a studio stores stays in DATA_DIR on your server. Prompts, storyboards and frames for the AI review are sent to Anthropic; voiceover text to ElevenLabs; payments go through Stripe; e-mails through Resend; stock searches to Pexels; only for the features you switch on with those keys. Mention these processors in your privacy policy. People can download their own data and delete their account from the studio's Account page.