Security & Trust

Uploaded audio is stored in a private object-storage bucket with no public listing and no guessable URLs. It is never served directly from that bucket to the open internet.

Every playback request is authorised first — against a review link, a password session, or your own logged-in account — and only then redirected to a signed URL that expires in five minutes. A link copied out of the network tab stops working almost immediately, and cannot be shared onward as a permanent download.

The same applies to delivery files, studio page images, and voice notes. There is exactly one unauthenticated audio route in the product — the public showcase player on a studio page — and it only serves tracks an engineer has deliberately published.

Access control is not only application logic. Row Level Security policies are enforced by Postgres itself, so a query cannot return another engineer's rows even if the application asks for them incorrectly.

That matters because it makes the most dangerous class of bug — one account seeing another's work — fail at the database rather than at whichever code path happened to be right that day. Where the design deliberately bypasses those policies (public review links, payment webhooks), the request is validated in the same handler before any row is read.

Delivery of final files is separate from review access, so a client reviewing a mix cannot reach the masters until you release them.

The database is hosted in the European Union, and application functions run in the same region so requests do not cross an ocean to read your projects. Object storage region is configurable.

Connections are TLS-only, with HTTP Strict Transport Security enforced in production, plus a Content Security Policy, frame-ancestor restrictions, and a restrictive permissions policy.

Engineers can see engagement on a review link — that it was opened, that a track was played, roughly how much was heard. This exists so you know whether a client has actually listened before you chase them.

IP addresses are hashed before they are stored. The raw address is never written to the database, for listening events or for download records. We do not use third-party advertising or cross-site tracking anywhere in the product.

Our operator console exposes operational metadata only — plan, storage usage, payment status, project titles and status. It does not expose client content: staff cannot play your audio, read your clients' comments, or listen to voice notes through it.

There is no impersonation feature. Nobody at tothemixhub can log in as you. Every administrative action, including simply opening an account record, is written to an append-only audit log that has no update or delete path.

You can export your account data at any time, and delete your account from Settings. Deletion is real: it removes your projects, audio, delivery files, review links, comments, and voice notes from both the database and object storage, running as a durable retryable job, and confirms by email when it finishes.

Records we are legally required to keep — principally payment records for tax purposes — are retained for the statutory period. Backups age out on a rolling schedule.

This section is here because a trust page that only lists strengths is not useful for making a decision.

No formal certification. We do not hold SOC 2, ISO 27001, or an equivalent audit, and we do not claim to. If your organisation requires one from its vendors, we are not yet a fit.

No independent penetration test. The application has been reviewed internally and hardened against the issues that review found, but no third party has tested it.

No SSO or SAML. Access is by email and password or Google sign-in. There is no enterprise identity integration.

No watermarked previews. A reviewer who can hear a track can record it. Share controls limit who gets access; they cannot prevent someone with legitimate access from capturing audio. If leak attribution is a hard requirement for a specific release, this is not the right tool for it yet.

No contractual uptime guarantee. The platform is in private beta and does not offer an SLA.

If you believe you have found a security issue, email privacy@tothemixhub.com with enough detail to reproduce it. Please give us a reasonable opportunity to fix it before disclosing it publicly.

We will acknowledge your report, keep you updated, and credit you if you would like to be credited. We will not pursue legal action against anyone who reports a genuine issue in good faith, does not access or modify other people's data beyond what is needed to demonstrate the problem, and does not degrade the Service for others.

There is no paid bug bounty at this stage. We would rather tell you that than imply one exists.

Privacy Policy · Data Processing Addendum · Terms of Service · Refunds & Disputes