F.01
Passwords hashed with argon2id
Not SHA-256, not unsalted, not something rolled by hand. argon2id is the current recommended password hash.
propshub.online
security · stated plainly
Security & access
What actually protects your production’s data.
Not marketing language. This is what’s in the code: how passwords are stored, how sessions expire, who can see which film, and what gets logged.
02 · What’s actually built in
Eight things, all verifiable, none of them a badge.
F.02
Short-lived sessions, long-lived refresh
Access tokens expire in 15 minutes. A refresh cookie — httpOnly, scoped to the auth endpoint — keeps you logged in for up to 7 days without ever putting the token where a script on the page could read it.
F.03
One switch revokes every device
Change a password, change a role, or log out, and every access token issued before that moment stops working — on every device, immediately.
F.04
Two-factor authentication, with recovery codes
TOTP 2FA on every account, on every tier. Lose your device and you still have your recovery codes; lose those too, and an admin can reset it — logged in the audit trail.
F.05
Per-film access, enforced on the server
Read, write or no access — explicit, per person and per group, per film. Checked on every request, not just hidden behind a button in the interface.
F.06
You can’t find a film exists by guessing
A film you don’t have access to and a film that doesn’t exist return the same 404. There’s no way to enumerate productions you’re not on.
F.07
Every permission-relevant action is logged
Who did what, and when — readable by an admin, exportable as a CSV.
F.08
Rate-limited and locked down
Login attempts are throttled through Redis. A strict content-security policy is set on every response.
03 · What’s encrypted at rest, specifically
One thing is encrypted at rest. It isn’t your production data.
If you connect an AI provider, the API key you give PropsHub is encrypted at rest with AES-256-GCM before it’s stored. That’s the one place PropsHub does at-rest encryption today.
Your scenes, props and inventory aren’t separately encrypted at rest — they’re protected the way described above, by access control and the audit log, not by encryption on the database itself. We’d rather say that plainly than let “AES-256-GCM” sitting on this page imply more than it does.
04 · What we haven’t published yet
One honest gap.
No published privacy policy or DPA yet
We’re a small, single-operator product and haven’t published a formal privacy policy or data-processing agreement. If your production needs one before it can sign off, tell us — we’ll get it done rather than make a claim we can’t back up yet.
Ask us anything on this page.
A security question gets a straight answer.
PropsHub is invite-only while we onboard the first productions by hand. Ask before you sign off, and we’ll tell you exactly what’s true today.