Security

Fableform is built for professional filmmakers working with sensitive pre-release content. We've designed our architecture to give your creative work maximum privacy while keeping the platform features that make production work possible.

Where Your Data Lives

Your media stays where you put it. Video, audio, images, and generated media, along with your project file (.fbl), are stored in the location you choose: your own machine, or a network drive you select for team sharing. Media you share with your team travels over that drive, not through us. When you use an AI feature, the content it needs (a prompt and its reference images, screenplay text for parsing, a conversation with the Fable assistant, or a dictation recording) passes through our servers to the AI providers that perform the task.

What lives on our servers, by design, is the coordination layer needed to run the platform:

• Account credentials, license, and device registration information
• Project registry data: project names, ownership, and collaborator permissions
• Synced project content (screenplay text, prompts, descriptions, comments, assistant memories, and media file names and locations) and rolling autosave backups, so your devices and collaborators stay in sync. Never the media files themselves.
• Fable assistant conversations
• Generation audit records, which include the prompts you submit, the AI provider used, generation cost, duration, and outcome, retained for billing, dispute resolution, cost tracking, and abuse monitoring
• Project memory embeddings: numeric representations of facts the Fable assistant saves, used to recall context
• Content moderation events for compliance with applicable law

This hybrid design keeps your media in the location you choose while letting the platform handle billing, audit, continuity, moderation, and collaboration.

Generation Pipeline

When you initiate a generation, your prompt and any reference images pass through our servers to the AI provider you have selected. Generated files return the same way and are held in temporary storage: they're available for one hour and deleted automatically within about a day. AI providers may retain prompts and outputs for limited periods under their own terms, for example for abuse monitoring; see our Privacy Policy for details.

Your prompt and a record of the generation (provider, timestamp, cost, outcome) are retained in the generation audit log described above. Prompt text is kept for three years; billing fields are kept for seven years for financial compliance.

Beta participants are subject to the data retention terms set out in their Beta Access Agreement, which govern the retention of generation records during the beta period.

No Training on Your Content

Fableform does not use your content to train AI models.

We use AI providers only under terms or account settings that prohibit training on content submitted through Fableform, and we continue to negotiate, update, and expand these protections as we add or evaluate new providers.

If you would like to know which AI providers are currently engaged for your generation requests, or to limit your generations to a specific subset of providers, contact us at privacy@fableform.ai.

Authentication and Access

Authentication uses JWT-based access and refresh token pairs with proactive refresh on the client. Access tokens expire after 24 hours; refresh tokens after seven days. Token handling and refresh logic are managed by our authentication service.

Project access is controlled by role-based permissions: owner, admin, collaborator, and viewer at the project level; owner, admin, and member at the team level. Access controls are being actively hardened ahead of public beta.

Encryption

Our servers run on Amazon Web Services (AWS) in the US East (Ohio) region. Databases, caches, storage buckets, logs, and secrets are encrypted at rest with customer-managed AWS KMS keys that rotate automatically, and database connections require TLS. Requests between the app and our servers are encrypted in transit using TLS, and WebSocket connections use TLS in production. Synced project data is encrypted at rest but is not yet end-to-end encrypted; end-to-end encryption is on our roadmap.

Credentials for our AI providers and other services are stored in AWS Secrets Manager and injected at runtime, never in our source code. We check that no secrets are committed to our source repository.

Local Data on Your Device

If you store projects on a third-party network drive, that provider's security controls apply. Project files on your local device are protected by your operating system's disk-level encryption, such as FileVault on macOS or BitLocker on Windows. We recommend enabling full-disk encryption on any device you use to work in Fableform. Application-level encryption for the local project database is planned for our native desktop release.

Monitoring and Audit

Generation activity is logged with per-user, per-project granularity, including AI provider, prompt, cost, duration, and status. Application logs are centralized in AWS CloudWatch and kept for 90 days, and services restart automatically on failure. Images are automatically screened for prohibited content, and moderation events are recorded for compliance. Project activity audit trails are part of our ongoing hardening work.

Blockchain IP Attribution

We have built infrastructure for on-chain IP attribution and royalty distribution using Thirdweb and 0xSplits on the Base network. This system is not yet active for production generations. When it goes live, on-chain registration will be opt-in and scoped to projects whose creators choose to register them.

Responsible Disclosure

If you discover a security vulnerability in Fableform, please report it to security@fableform.ai. We aim to acknowledge reports within 48 hours. We ask that you give us reasonable time to address the issue before public disclosure.

Questions?

For security-related inquiries, DPA requests, or enterprise compliance questions: security@fableform.ai