YouViCo Security: SOC2, GDPR, and Enterprise Protection

TL;DR

Why Security Matters: Microsoft’s Story

Microsoft’s creative team produces 140+ marketing campaigns annually. When they evaluated YouViCo, their security team had three requirements:

Data sovereignty - Where does video content live? (Microsoft’s data centers, not ours)
Encryption - Can we verify it’s not readable in transit or at rest?
Auditability - Can we prove who accessed what, when? Every enterprise sale hinges on these questions. We didn’t just meet them—we over-indexed on transparency.

Encryption Architecture

At Rest: AES-256 with Key Rotation

Video content and project metadata are encrypted using AES-256-GCM, the NIST-approved standard. The key management workflow:

Video Upload
	→ Client-side encryption (optional, for ultra-paranoid teams)
	→ Server-side AES-256-GCM encryption
	→ Key stored in AWS KMS (Hardware Security Module)
	→ Automatic key rotation every 90 days
	→ Old keys retained for 7 years (audit purposes)

Each workspace has its own encryption key. If a workspace is deleted, YouViCo zero-fills the storage blocks, then double-writes random data to prevent recovery via forensics.

In Transit: TLS 1.3 with HSTS

Every connection to YouViCo uses TLS 1.3 with forward secrecy, HTTP Strict Transport Security (HSTS) preloaded in browsers, and certificate pinning for mobile apps.

Zero-Knowledge Architecture: What YouViCo Can’t See

YouViCo cannot see customer video content. Ever. This isn’t just a privacy feature—it’s an architectural boundary. How it works:

Client-side processing - Video metadata is computed on the user’s device before upload
Opaque storage - Video binary is stored encrypted with a key YouViCo infrastructure cannot access
Transcoding isolation - Transcoding runs in an air-gapped environment with no internet access
Content-agnostic feedback - Feedback timestamps reference frame numbers, not content

SSO Integration: The Enterprise Expectation

YouViCo integrates with Okta, Azure AD/Microsoft Entra, Google Workspace, and Generic SAML 2.0. Just-in-Time Provisioning: When a new employee logs in via SSO, YouViCo automatically provisions a workspace account with their group memberships. Conditional Access Policies: Enterprise customers can enforce IP restrictions, MFA requirements, and geography-based access controls.

Audit Logging: The Compliance Backbone

Every action in YouViCo generates an immutable log entry. Logs are written to append-only storage, retained for 7 years, and each entry includes a SHA-256 hash of the previous entry (blockchain-style tamperproofing).

SOC2 Type II: The Two-Year Journey

SOC2 is the gold standard for B2B software security. Type II requires auditors to verify controls over 6+ months of operations. Our SOC2 scope:

CC (Common Criteria): security policies, incident response, change management
A&A (Availability & Accuracy): system reliability, data accuracy, business continuity
C (Confidentiality): encryption, access control, data segregation
CI (Confidential Information): customer data protection
PI (Privacy): GDPR/CCPA compliance Cost: ~$80K. Timeline: 9 months. Worth it? Absolutely. Every enterprise deal references our SOC2 report.

GDPR gives EU citizens five key rights. YouViCo implements all of them:

1. Right to Access

Customers can request a complete export of their personal data within 30 days.

2. Right to Deletion (Right to Be Forgotten)

When a workspace owner requests deletion, YouViCo immediately stops processing, marks for deletion (30-day grace period), and permanently erases all data after 30 days.

3. Right to Rectification

Users can correct incorrect personal data. Changes are logged for audit.

4. Right to Data Portability

Customers can export projects in standard formats (MP4 video, JSON metadata) and import them into competitors’ platforms.

5. Right to Restrict Processing

Customers can request YouViCo stop processing their data while legality is disputed. We implement this via a “freeze” flag.

Incident Response: When Things Go Wrong

Severity 1 (Critical): Data breach, service down

Alert security team immediately
Activate war room
Notify affected customers within 1 hour
Public status page updated within 2 hours Severity 2 (High): Partial service degradation, minor data leak
Investigate within 4 hours
Notify affected customers within 24 hours
Publish post-incident report within 72 hours Severity 3 (Medium): Single customer account compromised
Notify customer within 24 hours
Force password reset + invalidate sessions
Review logs for lateral movement We’ve had zero Severity 1 incidents since launch.

What We Tell Enterprise Customers

When a new enterprise prospect asks “How secure is YouViCo?”, we give them:

SOC2 Type II report (publicly available on our website)
Security whitepaper (covers architecture, threat model, controls)
DPA template (customer’s legal team can review)
References (3-4 existing customers who can vouch for our practices)
Incident response plan (proof we’ve thought about what-ifs) Transparency builds trust faster than claims ever will.

FAQ: Common Security Questions

Q: Where is my data stored? A: By default, US East (Virginia). Enterprise customers can request EU, Asia-Pacific, or Canada regions. Q: Can you decrypt my video without my permission? A: Technically, no. The encryption key is managed by AWS KMS, requiring AWS account compromise (separate from YouViCo). Q: Do you sell customer data to advertisers? A: Never. We’re paid by customers, not advertisers. Q: What if YouViCo gets hacked? A: Our encryption means hackers get encrypted blobs. They’d need AWS KMS keys to decrypt. Q: Do you comply with government data requests? A: We comply with lawful requests (subpoenas, warrants). We challenge requests when possible and notify customers when compelled to hand over data.

What’s Next

We’re working on:

End-to-End Encryption - Even YouViCo servers cannot decrypt video
Regulatory Certifications - ISO 27001, FedRAMP for government customers
Security Champions Program - Bug bounty for external researchers
Threat Model Reviews - Annual third-party threat modeling