Security
Your studio's data — and the client portals you put your name on — are protected by design, not as an afterthought.
Last updated June 2026
Client portal links
Each portal link uses a cryptographically random token. We never store the raw token — only a SHA-256 hash — so a database leak can't be turned into working portal links. Links carry an expiry and can be revoked instantly, which immediately cuts off access for anyone holding the old link.
Data isolation
Every record is scoped to its owner. Database row-level security ensures one studio can never read or modify another studio's projects, clients, invoices, or files — enforced at the data layer, not just in the application.
Encryption
All traffic is encrypted in transit with TLS. Files and assets are served through short-lived signed URLs rather than public links.
Authentication
Sign-in is handled by a managed authentication provider with secure session cookies, support for OAuth providers, and self-service password reset. Passwords are never stored in plain text.
Reporting an issue
Found something that looks off? Please email security@atelier.studioand we'll respond quickly. We appreciate responsible disclosure.