Security at UgcVids
Brands share unreleased products, launch dates and ad strategy with us. This page explains how we protect that information inside the order panel and in our work with creators, what controls Studio accounts get, and how to report a security concern.
Sign-in and SSO
Every account signs in with a work email and password, and new accounts confirm their address with a one-time code sent by email. Studio accounts can also sign in with single sign-on through the identity provider your company already uses.
- With SSO turned on, your team signs in with company credentials and your identity provider decides who gets in.
- When someone leaves your company and loses access in your identity provider, they lose access to the order panel too.
- Passwords are stored only as salted hashes, never in readable form.
- Sessions on shared or lost devices can be ended by signing out from account settings.
Roles and permissions
Seats in the order panel depend on your plan: 1 on Starter, 3 on Growth, 10 on Scale and unlimited on Studio. Studio adds roles, so each person sees and does only what their job needs.
| Role | What it allows |
|---|---|
| Owner | Billing, plan changes, seats, roles and every brand in the account |
| Admin | Seats and roles, briefs, approvals and downloads for all brands |
| Editor | Writing briefs, approving scripts and creators, comments and downloads |
| Viewer | Reading briefs and comments, previewing and downloading delivered files |
- Agencies running several client brands on Studio can limit a person to selected brands.
- Every approval of a script, creator or final video is recorded with the name of the person who approved it.
How files and briefs are stored and shared
Briefs, scripts, comments and video files live in your order panel. That panel is the only place we share them, and everything runs there in writing, without calls.
-
Connections to the panel are encrypted in transit.
-
Files and briefs are stored in access-controlled storage, and download links are personal, signed and expire after a short time.
-
We never post your videos publicly. A creator publishes on their own account only when your brief asks for a Spark Ads or partnership post.
-
Creators see only what they need for the shoot: the product brief, the approved script and the shot list. They never see your account, billing or other videos.
-
Our team accesses an order only to produce it or when you ask for help with it.
Creator NDAs for unreleased products
Launch content often has to be filmed weeks before the product is public. For those orders, the creator signs a non-disclosure agreement before receiving the product or the brief.
Mark the order as confidential in the brief, and add the date the product becomes public.
The creator agrees not to post, share or describe the product, the brief or the footage before that date, and not to post it afterwards unless your brief asks for it.
Raw footage and drafts are uploaded only to the order panel, never sent by message or personal cloud links.
Creators remove footage from their devices after delivery when the brief requires it.
Data handling
We collect only what we need to run your account and produce your videos: names and work emails of your team, briefs, comments, files and billing records. We do not sell this data and do not use your briefs or footage to promote other brands.
- Personal data of your team is used to run the account, send order updates and answer support requests.
- Creator data such as shipping addresses is shared only to the extent a shoot needs it.
- When you close the account, briefs and files are deleted on a schedule described in our privacy policy, except records we must keep for tax and accounting.
- You can ask for an export of your briefs and delivered files before closing the account.
Removing access
Access ends quickly and on your terms. You can remove a person, end a creator's involvement or close the whole account.
- Owners and Admins remove a seat from team settings, and the person loses access at once.
- With SSO, removing someone in your identity provider removes their access as well.
- When an order is delivered, the creator's access to its brief and files ends.
- To delete the account and its data, write to [email protected] from the Owner's email address.
Reporting a security issue
If you think you found a vulnerability in ugcvids.com or the order panel, or you notice unexpected activity in your account, write to [email protected] with the subject "Security". Describe what you found and how to reproduce it, and we reply by email.
- Please do not access, change or delete data that is not yours while testing.
- Give us reasonable time to fix an issue before sharing it publicly.
- If a security incident affects your account data, we tell you by email and explain what happened and what we did.