Last updated 21 October 2026
In transit
Every page and every API call of Sudio is served over HTTPS only. A plain HTTP request is redirected, and browsers are told to use HTTPS for a year (HSTS) for sudio.io and its subdomains.
Your files
Recordings, renders, uploads, storyboards and images are kept in private object storage. They cannot be listed, and none can be read without a signed link, which Sudio makes when a file is asked for: on your own pages it expires after about 15 minutes, and on a video or storyboard link you share, after about 2 hours. The in-app assistant never receives one.
Sign-in sessions for your site
When you sign in to your own site inside Sudio’s browser, so a recording can reach pages behind a login, the browser session you hand over is sealed with AES-256-GCM under a key only the recording service holds. The sealed session sits in private storage, never in a log or a database record, and it is never sent back to you or to an agent. It is used for at most 12 hours after you hand it over; dropping it deletes it at once, and so does a recording that finds your site has signed it out. Nothing you type in that browser is stored.
Keys
Your Sudio API key is shown once, when it is made; we keep only a SHA-256 hash of it, and you can revoke it at any time. The keys you add for your own model providers, and the token of a connected YouTube channel, are encrypted with AES-256-GCM under a separate key and are never shown back in full, to you, to an agent or in a log.
How long files are kept
Files are kept while a production uses them. A nightly run (03:15 UTC) removes:
- the files of an archived project or production: 30 days after it is archived
- a render replaced by a newer one: 24 hours after it is replaced
- a recording (recorded or uploaded), a voice take or a title card that nothing uses: after 7 days, unless you have named it to keep for later videos
- the files of a closed account: from the first nightly run after it is closed, a few hundred files a night
Pictures, sound and documents you upload stay until you remove them.
Training
Your recordings, scripts and videos are not used to train AI models, by us or by the model providers we use (their API terms exclude training on API data).
Who processes your content
Only these providers, each for its role and only with what that role needs:
- OpenAI: the generative models (scripts, storyboards, the in-app assistant), voice, and transcription
- ElevenLabs: voice, only when your account adds its own ElevenLabs key
- Verda: GPU video generation (realistic keyframes and films)
- Hanko: sign-in
- Mailgun (EU): email, such as a video link you send or a workspace invitation
- UpCloud: servers and file storage
- Google: YouTube, only when you connect a channel; and analytics, only when you accept analytics cookies
Reporting a security issue
Write to support@sudio.io. We answer every report, and we ask you to give us a reasonable time to fix an issue before you make it public.
See also the Privacy Notice and the Terms of Service.