You are trusted with other people's unreleased work. CoverQueue is built so that trust is enforced by the system, not just promised in a policy: watermarking on every delivery, isolation at the database level, and a firm stance on what we will never do with your content.
Every script that leaves CoverQueue is stamped server-side, per recipient, at the moment of delivery. Each page carries who received it, which organization sent it, and when, so a leaked PDF points back to a single recipient, not a shrug.
We keep one clean original per submission and never serve it directly. Watermarked copies are derived on demand and cached; the source file stays in the vault. Weekend-read packets and share links are stamped the same way, and every view and download is recorded to an append-only access log you can inspect and export.
Authorization lives in the database, not in the interface. Every table uses PostgreSQL row-level security (RLS) as the authorization system: access rules are enforced on every query, so a page that forgets a filter still cannot return rows a person is not allowed to see.
A freelance reader gets a link into exactly one script and never sees the rest of your slate. Owners, execs, and assistants see the org per their role. Reader isolation is a P0 guarantee for us: it is covered by an automated test suite that runs per table, per role, on every change, and a regression is treated as a release-blocking bug.
All data is encrypted in transit over TLS and encrypted at rest on our infrastructure provider, Supabase, by default, including the Postgres database and stored script files. Point-in-time recovery backups guard against data loss.
Privileged, state-changing operations run through audited, authorization-checked database routines rather than ad-hoc writes, which keeps the rules for who-can-do-what in one reviewable place.
Your archive is never held hostage. Full export (the submission log as CSV, coverage as PDFs, and your writers list as CSV) is available on every plan, including Free, so downgrading or leaving never ransoms your data.
You can delete your organization at any time. Deletion runs with a 30-day grace period before data is permanently removed, giving you a window to change your mind or pull a final export. We support GDPR and CCPA data-access and deletion basics through these same export and deletion paths.
Your scripts, coverage, and writer information are never used to train machine-learning models. Not ours, and not a third party's. Your confidential material is not a training corpus.
Any future AI-assisted feature (for example, a first-pass coverage draft) will ship behind an explicit opt-in, will always require a human to review and sign, and will run only under a provider contract that contractually prohibits training on your content. If that ever changes, you will hear it from us first.
Found something that looks wrong? We want to know. Email security@coverqueue.com with details and we'll respond promptly. Please give us a reasonable window to investigate and remediate before any public disclosure.
SOC 2 is on our roadmap but not yet certified. Questions from a security or procurement team? Get in touch, we're happy to walk through the details.