A new style of label
yeah, this is not us!
Tuning up
You're trusting us with unreleased music, your legal name, your money and your messages. Here's exactly how we look after them, in plain English, with the gaps listed too.
There are no passwords to steal. You sign in with a one-time link to your email (it works once and expires in 15 minutes), then confirm it's you with a second step:
Five wrong codes stops the sign-in and pauses the account for 15 minutes. If someone copies your sign-in to another browser, it stops working. New devices get an email straight away.
Even if someone gets into your email, they'd still need your phone or passkey to get in.
Everything we store sits on Cloudflare, which encrypts it at rest with AES-256 and in transit with TLS. On top of that we add our own layer:
Messages, legal names, emails and 2FA secrets are encrypted with our own key, on top of our host's encryption.
Every payment, quote, agreement, upload, message and email about you is written to an audit trail. Each entry carries a fingerprint of the one before, so editing or deleting anything breaks the chain. We check it every hour, and any break sets off a critical alert to both of us.
You can see your own record in your portal: every transaction and every piece of correspondence, with its fingerprint.
When Ben or Flick open one of your files, that's recorded too, and you'll see it. Bulk access is stopped automatically.
Payments run through Stripe Checkout. Your card details go straight to Stripe and never reach our systems. Stripe is certified to PCI Service Provider Level 1, the most stringent level in the payments industry.
The site, database and file storage run on Cloudflare, whose infrastructure is covered by ISO/IEC 27001 and SOC 2 certifications. Those are Cloudflare's certifications for their platform, not ours for our business; we say so because the difference matters.
The site sends strict security headers, blocks other websites from acting on your account, and checks forms for bots.
The Australian Signals Directorate's Essential Eight is the government's baseline for cyber security. We've assessed ourselves against it, aiming for Maturity Level One. It's a self-assessment, not a certification.
| Strategy | What we do |
|---|---|
| Multi-factor authentication | Yes. Every artist and admin account, plus our Google Workspace, Cloudflare, Stripe and email accounts. |
| Restrict admin privileges | Yes. Two named admins only, by allow list; 12-hour sessions; every admin action logged. |
| Regular backups | Yes. Point-in-time database restore on the platform and regular off-site exports, test-restored. |
| Patch applications | Yes. Managed, auto-patched platform; our code's libraries pinned and reviewed monthly. |
| Patch operating systems | Yes. Serverless hosting is patched by the provider; our own devices update automatically. |
| User application hardening | Yes. Strict content security policy and browser protections on sign-in and admin pages. |
| Application control | Partly. Only approved code runs on the platform; laptop allow-listing is on our list. |
| Office macro settings | Not used. We don't run Office macros. |
Independent outside scans of the live site (Mozilla Observatory and SSL Labs). We'll show the grade here once we have it, not before.
We collect what it takes to release your music and pay you properly, and nothing to sell. We follow the Australian Privacy Principles, and if a breach ever risked serious harm we'd tell you and the Office of the Australian Information Commissioner, as the notifiable data breaches scheme describes.
When you leave, your account closes. We keep money records for 7 years (the law requires at least 5). Everything else is deleted after 12 months. Full details are in our privacy policy.