PPL · Security & Trust
Consent isn't a checkbox. It's a gate the system enforces.
Trust you can't show isn't trust. The controls below run as gates in the pipeline, not promises in a policy. Here's how the system is built.
Trust you can't show isn't trust. The controls below run as gates in the pipeline, not promises in a policy. Here's how the system is built.
Every record is protected by row-level security: a person reads their own data and no one else's. The privileged service key never ships to a browser — client surfaces use a public key bounded by those same row-level rules.
Nothing generates without a matching, in-scope consent on file. The gate runs before any likeness enters memory, and it default-denies — if the consent or the scope doesn't cover the use, the studio refuses to build it.
Withdraw once and it flows everywhere: every new-work gate refuses in the same transaction, renewal closes, and the verify record says so in public — while delivered in-term work runs to its term, exactly as the contract promises. A withdrawn yes is honored across every surface, not just the one you clicked.
Consent to finished frame is time-stamped and exportable — the whole chain, on the record. Inbound verification events are signature-checked with replay protection, so only genuine, fresh events ever move a member's status.
Questions about how this works? We'll walk you through it.