SFN AI
How it works For creators
Log inBook a call
How it worksFor creatorsLog inBook a call
SECURITY

Security at SFN AI

Last updated: 6 August 2026
Privacy Terms Security Cookies Sub-processors

1. Purpose and scope

This page describes the technical and organizational measures Short Form Nation, Inc., doing business as SFN AI, uses to protect the data processed through the SFN AI platform and services. It also tells you how to reach us about anything security related.

This page is a description of practice. It is not a contract and it does not create rights. It states what is true today. Where a control is not in place, this page says nothing about it rather than describing an intention as a control.

What we collect, why, how long we keep it and what rights you have are covered in our Privacy Policy. Tracking technologies are covered in our Cookie Policy. The vendors that process data for us are listed on our Sub-processors page. This page does not repeat any of them.

2. Our security program

SFN AI maintains a written information security program. It is a set of adopted policies and procedures covering the systems that hold customer and creator data, and it is owned by our CTO. Every document below was adopted on 6 August 2026.

DocumentWhat it covers
Information Security PolicyBaseline posture, ownership, systems in scope, review cadence
Network Security PolicyHow access to production systems is restricted, and how those rules are reviewed
Endpoint Protection PolicyControls required on any device that can reach production credentials or data
Access Control PolicyLeast privilege, credential rules, access review, offboarding
Data Classification and Encryption PolicyWhich data counts as personal data, and how each tier is encrypted
Incident Response PolicyRoles, escalation path, reporting channels, response steps
Vulnerability and Threat Management ProcedureHow vulnerabilities are found, triaged and remediated
Data Retention and Deletion ProcedureWhat is deleted at the end of a relationship, and how fast
Breach Notification ProcedureWho is notified, by whom, and how quickly

The program is reviewed at least annually, and immediately after any confirmed security incident, any material change to our production network, or the onboarding of anyone new with production access. The next scheduled review is 6 August 2027.

Security is a shared responsibility. We protect the platform. You are responsible for using strong, unique credentials, for keeping your account access confidential, and for the activity that happens under your account. If you suspect unauthorized access, tell us at security@shortformnation.com without delay.

3. Encryption

In transit. All public endpoints enforce TLS 1.2 or higher. Traffic between you and SFN AI is encrypted over the public internet, and administrative access to our cloud provider runs over TLS as well.

At rest. Our production database storage is encrypted at rest using AES-256. The queues that carry operational data between our services are encrypted with managed keys held in AWS Key Management Service. We use provider-managed keys, which removes a class of key handling risk rather than adding one.

Our Data Classification and Encryption Policy sets the standard those controls meet. It names which fields count as personal data, which count as de-identified or aggregated, and which are purely operational, and it requires personal data to be encrypted at rest with AES-256 or equivalent and transmitted only over TLS 1.2 or higher.

4. Infrastructure and network

SFN AI runs on Amazon Web Services. Our application, database, queues and processing jobs all run in the AWS Frankfurt region. Our marketing website is hosted on Netlify. The physical, network and environmental controls in those data centers are the providers' own, are described in the providers' compliance documentation, and are not ours to represent.

  • Network access to our production database and to internal service traffic is restricted at the security group layer to named peer services and an explicit, individually labelled list of administrative IP addresses. It is not open to the internet at large.
  • Database access additionally requires credentials. Network reachability alone does not get anyone in.
  • Every entry on the administrative allowlist has to carry a label identifying who or what it is, and the list is reviewed quarterly with stale entries removed.
  • Each of our serverless functions runs under its own scoped role rather than a shared account-wide one, so a function can only touch the specific resources it needs.

We do not claim a segmented network architecture. Our Network Security Policy sets that as the target state and the work to get there is scheduled, not finished. We would rather tell you what is running today than describe a plan as a control.

5. Access control and authentication

We have a written Access Control Policy. Access to production systems and to personal data is granted per named individual, scoped to the minimum permissions the role requires, and reviewed.

  • Least privilege in practice. Our external analysis consultant holds four read-only, domain-scoped policies with no database, billing or write access at all, and cannot use them without multi-factor authentication. Our automated upload account has no console login whatsoever and is limited to programmatic keys.
  • Access review. We have committed to a documented access review at least annually, confirming that every account still needs the access it holds.
  • Offboarding. Any departing contractor or consultant has credentials, authentication devices and repository access revoked within 24 hours of the engagement ending.
  • Logging. AWS CloudTrail retains API level access logs across the account, so administrative actions against production are recorded.
  • Secrets. Application secrets are held in AWS Secrets Manager and read at runtime by the specific functions permitted to read them. Committing credentials or environment files to source control is prohibited.
  • Devices. Screens auto-lock after inactivity on any device with production access.

6. Application security

Security checks are enforced automatically on every change, by machines rather than by memory. Our continuous integration pipeline blocks a pull request that violates any of them.

  • Database queries must be scoped. Unscoped queries against large tables fail the build.
  • Runtime schema reflection is prohibited and is tested for.
  • Connection pool safety is enforced on every database engine we create.
  • A known dangerous join pattern against large tables is blocked outright.

We treat these as security controls and not only as performance controls, because each of them has caused a real production failure in the past. We patch dependencies and infrastructure in response to known vulnerabilities.

7. Vulnerability and threat management

We have a written Vulnerability and Threat Management Procedure. It defines the code level controls described above, the remediation severity bands we work to, and the retention period for findings.

Being direct about the limits of this: we do not currently run continuous automated vulnerability scanning across our cloud infrastructure. That is a scheduled item, not a finished one, and until it is running we would rather leave the sentence off this page than describe it in softer words.

8. Monitoring and incident response

We have a written Incident Response Policy with named roles, an escalation path and defined response steps. Our CTO is the incident commander and owns triage, containment, remediation and the decision to communicate externally.

  • Reporting channel from outside. security@shortformnation.com is a live, monitored channel for reporting suspected unauthorized access or a vulnerability.
  • Detection from inside. CloudWatch alarms cover function errors, dead letter queue depth and pipeline step failures, and route to the CTO. Failure propagation through our processing pipelines is enforced in code, so a failed step surfaces rather than passing silently.
  • Response. Triage of severity within four hours of a report. Then containment through credential revocation and resource isolation, scope assessment, notification, root cause fix with a written analysis, and a post-incident review within five business days.

Breach notification. If there is a breach of security leading to unlawful or unauthorized access to, acquisition, disclosure, loss or destruction of personal information we process, we will notify affected parties, and where we act as a service provider or processor, the affected customer, without undue delay and consistent with applicable data breach notification law. Internally, our incident commander must issue at least a preliminary notification within 72 hours of confirming that an incident involves personal data. Notifications describe the incident, the categories of data involved and the measures taken, to the extent then known.

9. Breach and complaint history

In the three years to 6 August 2026, SFN AI has not experienced a personal data breach that it notified, or was required to notify, to a regulator or to a customer.

Over the same period we have not received a complaint or regulatory correspondence about our processing of personal data.

10. Backups

Our production database runs automated backups with 14 day retention and point-in-time recovery. Backup storage inherits the same AES-256 encryption at rest as the database itself. Message queues retain undelivered messages in a dead letter queue for 14 days rather than dropping them, and the queue infrastructure is redeployable from templates.

Personal data captured in routine backups is purged as those backups age out of the retention window. There is no separate manual purge step once the primary records have been deleted.

11. Endpoint protection

Any laptop that can reach production credentials, our source repository or systems holding personal data is covered by a written Endpoint Protection Policy. On every such device today:

  • FileVault full disk encryption is enabled.
  • Gatekeeper is enabled, which blocks unsigned and unnotarized executables.
  • Operating system auto-update is enabled, which keeps the platform malware signatures current.

We do not yet run a dedicated managed endpoint detection product. Selecting and deploying one is a committed item in the same policy. Any malware detection or compromise on a device with production access triggers the incident response process immediately, including rotation of every credential that device held.

12. Our people

SFN AI is a small engineering organization. Access to customer and creator data is limited to the people who need it to operate and support the service, and that limit is implemented in the access policies described in Section 5 rather than left to good intentions.

Any contractor or consultant granted access to our systems is bound by a written confidentiality agreement and is scoped to least-privilege, read-only access before that access is issued.

13. Payment, identity and tax data

Content Rewards involves the most sensitive information SFN AI touches. This section says where it goes and who holds it.

Pay-in. A seller purchases a campaign service from SFN AI and pays SFN AI for it. SFN AI is the merchant of record, and Stripe, Inc. processes those payments. Card details are entered into and handled by Stripe. Stripe's security controls and certifications are Stripe's, and we do not represent them as our own.

Payout, identity and tax. SFN AI commissions content from creators in its own name and pays each reward from its own funds, as its own obligation. A seller never pays a creator. Trolley, or another financial partner we designate, executes those payments. Before a creator's first payout, identity verification and tax documentation, including a valid IRS Form W-9, are collected by Trolley through an embedded onboarding flow. Age is verified as part of that process.

What we do not store. Identity document images, full taxpayer identification numbers and full bank account numbers are collected and held by Trolley in its own secure frame. SFN AI does not store any of them. Our product analytics recordings do not capture those screens, because they are served by Trolley from a separate origin.

SFN AI is a technology platform, marketing services provider and content production company. SFN AI is not a bank, money transmitter or financial institution, and does not offer deposit, checking, savings, stored value, prepaid or money transfer accounts or services.

14. Where your data is

Our application and its data stores run in AWS Frankfurt, Germany. The AI model inference we run to generate angles, content ideas and scoring also runs in Frankfurt. Our product analytics provider processes in the European Union. Our marketing website is hosted on Netlify's distributed edge network.

Administrative access originates from the personal devices of our founding team, including while travelling. Every one of those access points is individually listed on the allowlist described in Section 4, and all administrative access runs over TLS. As a matter of policy, personal data is not persisted to local devices.

Per-vendor detail, including exactly what each one receives and where it processes, is on our Sub-processors page.

15. Retention and deletion

We have a written Data Retention and Deletion Procedure with an owner, a trigger and a runbook.

  • Identifiable personal data is deleted within 30 days of the end of the relationship, or of an individual deletion request. That covers content, credentials and any record tied to an identifiable seller, customer or creator.
  • Every deletion run is logged, including which tables were touched, how many rows and when, so it can be audited afterwards.
  • Backup copies persist only until they roll off the 14 day retention window described in Section 10.
  • De-identified, aggregated data is retained indefinitely. This is derived analytics and benchmark signal that does not identify any individual. We are stating that plainly rather than leaving it implied: deletion removes the data that identifies you, not the anonymized aggregate learning derived from it.
  • Anything we are legally required to retain persists for the required statutory period and no longer.

Deletion and access requests are fulfilled manually by our engineering team today rather than through a self-service flow. How to make one is set out in our Privacy Policy.

16. Vendors and sub-processors

We use third-party service providers to operate SFN AI. Each one receives only the information it needs to perform its function, and we require appropriate security and confidentiality protections by contract.

Any new provider that would receive seller or creator personal data has to be reviewed against our Information Security Policy before it is integrated.

This page points at the list. It does not keep a second one. The current providers, what each receives and where each processes are set out on our Sub-processors page, which is dated so you can see when it was last reviewed.

17. Certifications

SFN AI does not hold a SOC 2 Type II report and does not hold an ISO/IEC 27001 certification. Nothing on this page should be read as claiming otherwise.

Our cloud infrastructure providers hold their own certifications. Those are the providers' and not ours.

18. Responsible disclosure

We welcome reports from security researchers and from the wider community. If you believe you have found a vulnerability or a security issue in SFN AI, report it to us privately so we can investigate and fix it before any details are made public.

  • Email security@shortformnation.com with enough detail to reproduce the issue.
  • Give us a reasonable opportunity to remediate before public disclosure.
  • Do not access, modify or delete data that does not belong to you, and avoid anything that could degrade the service for others.
  • Test only surfaces SFN AI operates. This page does not authorize testing against Stripe, Trolley, TikTok, or any other third-party system, and we cannot authorize it on their behalf.

We appreciate good-faith research and will work with you to confirm and resolve valid reports.

19. No guarantee

No method of transmission over the internet or of electronic storage is completely secure. We do not warrant that the SFN AI platform and services, or any data, will be free from unauthorized access. We work to protect your information and we improve our practices as threats and technology change, but we cannot guarantee absolute security.

Contact Our Security Team

For security questions, vulnerability reports, or to request more information about our security practices, please contact us:

Short Form Nation, Inc.
Security Team
Email: security@shortformnation.com
Address: 2261 Market Street STE 22574
San Francisco, CA 94114
United States

Data protection and privacy contact
Tad Slaff, Chief Technology Officer
Email: tad@shortformnation.com
SFN AI

We watch TikTok Shop 24/7. You get the playbook.

LinkedInXTikTokInstagramDiscord
POWERED BY
NVIDIA InceptionBytePlus
PRODUCT
Creators How it works Pricing
PROOF
Case studies Reports Results
RESOURCES
Blog Help Discord
COMPANY
About Partners Contact
PRIVACY TERMS SECURITY COOKIES

Your Privacy Choices

We share limited information with advertising and analytics partners so we can measure our campaigns and show SFN AI ads on other sites. Under California law and comparable state laws this counts as sharing for targeted advertising, and you can opt out.

Your browser is sending a Global Privacy Control signal. We have already applied your opt-out. You do not need to do anything else.

This applies to this browser on this device, because that is where the choice is stored. It does not stop strictly necessary cookies, and it does not delete information already shared before you opted out. You can also email tad@shortformnation.com and we will apply it without asking you to create an account. More detail is in our Privacy Policy and Cookie Policy.

© 2026 SFN AI