Each brief's title, every saved version, briefing notes, the office response and review comments are encrypted before they're stored, as are any uploaded reference documents. Each office has its own key. Someone with only a copy of the database or a backup can't read them. If an office is deleted, its key is deleted too, so anything left in old backups becomes unreadable.
Every version, every view on record
Edits never overwrite a brief: each save creates a new version, and approval applies only to the exact version a different administrator reviewed. Administrators can see who opened, approved or shared each brief.
You decide how long briefs are kept
Administrators can permanently delete a brief with all its versions and review history, or have briefs deleted automatically after a chosen period without changes.
Only your team, by role
A signed-in account in your organisation is required to open a brief, and StoryOps checks the brief belongs to your office before returning it. Reader, Editor and Administrator roles control reading, editing and approval. Text you choose to copy or share leaves the workspace.
Extra protection when you want it
Anyone can turn on two-step sign-in, so a password alone isn't enough, with one-time recovery codes if a phone is lost. In the phone app you can require Face ID, fingerprint or your device passcode to open StoryOps. Brief screens are kept out of the app switcher, and on Android out of screenshots and screen recordings.
Hosted on Railway
StoryOps application data is stored on Railway, whose infrastructure also provides encryption at rest. Your connection to the app uses HTTPS. App services communicate over Railway's encrypted private network.
Necessary operational access
Authorised operational staff may access data for support and maintenance; encrypted brief content isn't readable from the database itself. StoryOps' internal administration tools need both a password and a one-time code. Hosting and other service providers process data needed to operate StoryOps, as described in our Privacy policy.
How AI uses relevant content
When you use AI features, relevant source evidence, office context, questions or draft text are sent to our AI providers (Anthropic and OpenAI) to generate or refine the result. Check the Privacy policy for information about processing and your data choices.
Questions about how your briefs are protected? Contact patrick@storyops.news.