Security and data

Where your data lives

Your studio's data is stored in the EU, in an Amazon Web Services data centre in Ireland, through our hosting platform, Lovable Cloud. Billing details are the exception: our payment provider, Stripe, keeps them in the EU and the USA. Some of our hosting platform's own providers, listed below, work outside the EU (in the UK and the USA, and worldwide for delivering pages) for delivery, logs and monitoring, under an adequacy decision or the EU's Standard Contractual Clauses.

Every connection to SilkRaven is encrypted, and stored data is encrypted too.

Our hosting platform, Lovable, holds ISO 27001:2022 and SOC 2 Type II for its platform; you can request the reports from Lovable's trust centre. trust.lovable.dev (opens in a new tab)

SilkRaven has no certification of its own. Instead, this page and our data processing agreement say exactly what we do, and we answer your questions in writing.

Who can see what

Every table in our database has access rules, and the database checks them whenever a person reads or changes something: each person can only see and change the games they're a member of, in the way their role allows. The content of your games is never visible to other studios.

Company and studio admins see their people, and each game's members, roles and domains, so they can choose who leads it. They don't see a game's content unless they're on the game.

SilkRaven measures work, never people. There are no leaderboards of individuals, no time tracking and no productivity scores; workload is shown per team, and nothing is decided about anyone automatically.

Unreleased content and files

Files are kept in private storage. A file only opens through a link our server makes for one person and one file, after checking they're on the game, and each link stops working within 65 minutes. One person can open up to 200 files an hour, which limits how much a stolen session could take.

Download totals are kept per game, never per person. The hourly count behind the 200-file limit is never shown to anyone and is deleted within 3 hours.

Signing in

Sign in with your email and a password, or with Google or Microsoft. We only store a secure hash of a password, never the password, and we refuse passwords under 8 characters or ones found in known data leaks.

Two-step sign-in for SilkRaven's own passwords isn't available yet. If your company uses Google or Microsoft accounts, signing in with them follows your company's rules for those accounts, including two-step sign-in.

How we run SilkRaven

One person can administer SilkRaven: its founder. Every account that can reach your data uses two-step sign-in.

Keys and passwords for the services we use are kept in our hosting platform's secret store, never in our code.

Every change is checked against written rules and passes automatic tests before it's released; changes to the database are reviewed and tested before they're applied. We get alerts about known weaknesses in the software we build on.

Invitations and notices go out through Resend's EU region, with open and click tracking switched off. Sign-in emails, such as confirming your address or resetting a password, are sent by our hosting platform, Lovable.

Backups

Our hosting provider backs the database up every day, in the same EU region, and keeps each backup for a limited time.

Uploaded files aren't backed up yet, so keep your own copies of anything you can't lose.

You can also ask us for an export at any time.

AI

SilkRaven has no AI features, and the app sends none of your studio's data to an AI service. We don't use AI tools on your data.

If we add AI suggestions later, they'll be off unless your studio switches them on, nothing they suggest is saved unless a person accepts it, and our privacy policy will name the provider and what's sent before they go live.

Your data

Your studio's data is yours. Ask us for an export of your games at any time by emailing kat@silkraven.com, the address our privacy policy gives for anything about your data; an export button is coming. A cancelled game stays as a read-only archive for 12 months. If you leave SilkRaven, you can still ask for your export for 90 days, and then we delete your content, except anything the law requires us to keep.

To delete a game or an account, email kat@silkraven.com: a game is erased within 30 days, files included, and from our backups when they're overwritten; deleting an account erases its name and email. Past sign-offs stay in the game's history as "Former member", because the studio's record depends on them.

If something goes wrong

If your studio's data is affected by a breach, we tell your studio without undue delay and within 48 hours of finding out, with what we know and what we're doing, and add details as we learn them. Your studio decides about your game's data, so it tells the data protection authority within 72 hours where the law requires, and we help. For data we're responsible for ourselves, such as accounts, we tell the authority, and we tell people directly if there's a high risk to them.

Our status page shows whether SilkRaven is working, and how available it was each month. status.silkraven.com (opens in a new tab)

Who processes your data for us

These services process your studio's data on our instructions, under data processing agreements with us. We tell you at least 30 days before we add or replace one, and you can object.

For our own data, such as billing, our status page and our mailbox, the privacy policy lists the services we use.

Report a security problem

If you think you've found a security problem in SilkRaven, email security@silkraven.com with what you found and how to reproduce it. Please don't access other people's data or disrupt the service while you look, and give us a reasonable time to fix it before telling anyone else.

If you follow these steps in good faith, we won't take legal action against you.

Our security.txt

Security reviews and questionnaires

Send us your security questionnaire at security@silkraven.com and we'll answer it in writing.