Security
How DemoSix protects your data
For IT and security teams reviewing DemoSix. Send questions or a security questionnaire to support@demosix.com.
Where your data is
In the United States
DemoSix stores and processes data in the United States. Our servers, database and file storage run in the US East region, around Washington, D.C. and northern Virginia.
The companies we use
Vercel hosts the site and its files, Neon the database, Mux the videos, Clerk sign-in and Stripe payments. The full list, with what each one does, is in section 3 of our Privacy Policy.
Encryption
In transit
Every page, API call and webhook uses HTTPS. Browsers are told to use nothing else.
At rest
The database and stored files are encrypted with AES-256 by Neon and Vercel.
Connected CRM sign-ins
When you connect a CRM, DemoSix encrypts its sign-in with AES-256-GCM before storing it.
API keys and webhook secrets
Keys are stored only as SHA-256 hashes, and webhook secrets are not stored at all. Each is shown once, when it is made.
Access
Sign-in
Clerk runs sign-in. Passwords go to Clerk and never reach DemoSix's servers.
Roles
A workspace has an Owner, Admins, Contributors and Viewers, and each sees only what their role allows.
Private videos
Videos in private Networks play only through signed links, and only for members.
Payments
Card details are typed into Stripe's own form and never reach DemoSix.
Abuse protection
The site sits behind Vercel's firewall and automatic DDoS protection, and the API is rate limited per key.
Keys and integrations
API keys
Only the workspace Owner makes keys. A key reaches only the Networks chosen for it, never changes a lead, a demo or a Network, and can be set to expire. The Owner is emailed when a key is made, revoked or first used from a new country.
Webhooks
Every message is signed, and is sent only to a public https address. Details for your engineers are on the Developers page.
When something breaks
Error reports
Errors are sent to Sentry, our error tracker, with the account they happened to, so we can fix them.
The minute before an error
On signed-in account pages only, the minute before an error is sent with every character of text masked, and nothing typed, no image and no video. Lead forms, watch pages, sign-in and checkout are never recorded.
How long we keep data
Leads
A lead with no activity for 12 months is deleted, with everything attached. The second-by-second record of what a lead watched is gone within 90 days; the summary stays.
Videos and accounts
Deleted videos are removed after 7 days. Deleting an account removes its workspaces, Networks, videos and files. Backups keep data for up to 30 days.
Your requests
To see, correct or delete personal data, see section 8 of our Privacy Policy.
Report a problem
Found a security problem?
Email support@demosix.com. Please do not test against other customers' data.
security.txt
Our contact details are also at /.well-known/security.txt, the standard place security researchers look.