Your unreleased game stays private and safe
Your Unreal project is your most valuable work. It stays private, never public, and never lost. Here is exactly how, and how to verify it yourself.
How we keep your project safe
Private storage, signed access
Your files live in private storage in EU data centers. Never public. Every upload and download happens over a short-lived, encrypted (TLS 1.2+) link scoped to a single project, so files are never publicly addressable and every link expires quickly.
SHA-256 integrity verification
Every file is hashed on upload and checked again on download. You always get back the exact file you put in, byte for byte. Silent corruption is caught before delivery.
Role-based access control
Three clear roles (owner, admin, member) plus per-project membership. Contractors and freelancers get access to what they need, nothing more.
Audit logs
Every commit, upload, download, restore, membership change, key creation, and key revocation is logged with the member and timestamp behind it. Available in the dashboard on Studio and above. A separate per-project access log records the devices your project keys are used from.
Source-available desktop app
Enterprise customers get the desktop client source code. Read the source, build it yourself, verify exactly how your data is handled. No black boxes.
Device-locked, scoped API keys
Keys are scoped to a single project, stored only as SHA-256 hashes, and revocable instantly from the dashboard. Each key also binds to the first machine that uses it, so a leaked or shared key is refused everywhere else.
How access control works
Access is layered: • Organization-level roles determine what you can do across the org. Owners handle billing, admins manage teams, members do the work. • Project membership determines which projects a member can see. A contractor added to one project has no visibility into the rest of your org. • API keys are scoped per project. A desktop app linked to one project can't access another, even if both belong to the same org. This layered model means you can bring on a freelance texture artist for two weeks, give them exactly the access they need, and remove it cleanly when the engagement ends.
Data handling and storage
Your files are stored in private object storage in EU data centers, with physical and logical security controls. The storage is never publicly accessible: the desktop app and web dashboard reach your files only through short-lived signed links that are scoped to a single project and expire quickly. There are no permanent public URLs. Every file is verified with a SHA-256 hash on upload and again on download, so silent corruption is caught before delivery. If a stored file doesn't match its hash, the system refuses to deliver it. Metadata (commit messages, version history, project structure, membership) lives in PostgreSQL with standard database-level security controls.
Who can access your files
Your team controls access through org roles and per-project membership. On our side: we don't sell your files, advertise against them, or train any model on them. We access file contents only to operate the service or when you ask us for support, and that access is limited and logged.
Authentication
Web access is protected by a dedicated managed authentication provider (Clerk), with email verification and time-limited sessions. Desktop and CLI access uses per-project API keys prefixed with `usc_`. Keys are stored as SHA-256 hashes server-side, so even a complete database compromise wouldn't expose raw credentials. Keys can be rotated from the dashboard at any time. For Enterprise customers, SSO / SAML integration is available. Contact us to discuss.
Verifying our claims
Most of our security posture is observable: • The desktop app source code is available to Enterprise customers. Read the code, check the hashes, build it yourself. • The API is documented and uses standard HTTPS. Inspect traffic yourself. No proprietary protocols, no obfuscation. • The audit log is in the dashboard on Studio and above, filterable by event type and date range. Every project also has an access log showing which devices have used its keys, including attempts that were refused. For studios with formal compliance requirements (SOC 2 type 2, data residency, specific contract terms), Enterprise plans include appropriate documentation and controls. Contact us for your security review checklist.
Common questions
Are files encrypted at rest?
Files are stored in private EU data centers and are never publicly addressable. For customers requiring customer-managed encryption keys or specific crypto controls, Enterprise plans offer additional options. Contact us to discuss.
Where is my data stored?
Your files are stored in private object storage in EU data centers, reachable only through short-lived signed links scoped to your project. Customers with specific data-residency requirements should talk to us about Enterprise options.
What happens if an API key is compromised?
Regenerate the project's key from the dashboard. The old key is invalidated immediately. Check the audit log for any unauthorized activity. We can help trace it if needed.
Do you support SSO?
SSO / SAML integration is available on Enterprise plans. Contact us with your identity provider details.
Can I get audit data out of the dashboard?
Studio and above include the audit log in the dashboard, filterable by event type and date range. Programmatic export for your own security tooling is available to Enterprise customers on request; talk to us about the format and retention you need.
What's your incident response process?
We maintain an incident response plan and notify affected customers promptly. Enterprise contracts include notification SLAs specific to your requirements.
Have you been audited?
SOC 2 type 2 certification is on the roadmap. Enterprise customers with immediate compliance needs should contact us to discuss current controls documentation.
Keep your game private and safe
From $25/user/mo. Private by default, and ready as soon as you're set up.
Create your first project