Security & Data Protection

This page summarises how Freedam protects the files, metadata and accounts in your workspace, and links to the pages where you configure each part. It is written for workspace administrators and for anyone answering a security questionnaire about Freedam.

This page has no screenshots: most of what it describes runs without any setting. The pages it links to show the settings that exist.

Where your data is stored

• Location: hosted Freedam workspaces run on dedicated infrastructure in Germany.
• One database per workspace: every workspace has its own database. Your assets, metadata, users and settings are never stored in the same database as another customer's.
• Separate file storage: each workspace's files are stored under their own storage area, in a private bucket. Files are delivered through signed links that expire after seven days, so a link copied out of the application stops working.
• Backups: the database and the files are backed up every night and stored off-site, with a full workspace snapshot every week. Restores are tested every week. See Backups & Disaster Recovery.

Encryption

• In transit: all traffic between your browser and Freedam uses HTTPS (TLS). Browsers are told to use HTTPS only for a year (HSTS), including on subdomains.
• Sessions: the session cookie is encrypted, sent over HTTPS only, and not readable by scripts in the page.
• Stored credentials: the passwords and secret keys of connected sources and webhook signing secrets are stored encrypted.

Virus scanning

Uploaded files are scanned for viruses before they are stored or shown to anyone (see Uploads). A file in which a virus is found is rejected: its tile shows Virus Detected and the file is not added to the library.

The same scan applies to files imported from connected sources and uploaded through the API.

Signing in

• Passwords: at least 12 characters, with upper and lower case letters, numbers and symbols. A password that appears in a known data breach is refused.
• Failed attempts: after 5 failed sign-ins for the same email address from the same network, sign-in is blocked for a short time.
• Single sign-on: people can sign in with their company Google or Microsoft account, and you can require single sign-on for everyone except administrators. See Access Settings and Signing In.
• Who can join: you decide whether people can register, from which email domains, and whether an administrator must approve each new account. See Access Settings and User Requests.
• Account expiry: give external users an expiry date so their access ends with their contract. See Users.

Access control

Access rules are checked on the server for every preview, download and API request. Hiding a button in the interface is never the only protection.

Audit logs

• Rights and downloads: every rights decision, acknowledgement and download is recorded and can be exported. See Rights Logs.
• API requests: every request made with an API token is recorded with the user, the token, the request and the IP address. See API authentication.
• Settings changes: changes to workspace settings are recorded, without the values of secrets. Ask the Admin Assistant "What changed recently?" to read them.
• Public links: views and downloads are counted per link. See Public Shares.

Personal data

For the personal data your team stores in Freedam, your organization is the controller and Freedam processes the data on your behalf. The privacy policy describes what Freedam collects.

• Deleting a person: an administrator can delete a user permanently. Their personal data is removed and the content they own moves to another user. See Deleting Users.
• Terms acceptance: when you publish terms of use, Freedam records which version each person accepted and when. See Terms of Use.
• Usage analytics: the analytics inside your workspace are stored in your workspace's own database. IP addresses are stored only as a one-way hash. Sign-in, registration and access request pages are not tracked. See Analytics.
• Cookies: the application sets only its own cookies: the session, protection against cross-site request forgery, and display preferences such as the language, the theme and the gallery layout. It sets no advertising or third-party tracking cookies.
• Faces: face detection and the names given to people are stored in your workspace and can be removed. See Faces and People.

AI processing

Some features send data to AI providers:

• Automatic tagging sends a reduced-size preview of each image, never the original file, to the AI model assigned to image enrichment. See Automatic Tagging.
• AI chat, translation, Studio and the Admin Assistant send the text of your request, and the images you edit in Studio, to the model assigned to that operation.
• Search embeddings and video transcription run on Freedam's own servers.

Administrators see which provider and model handle each operation, and every call with its cost, on the AI Settings page.

Good to know

• Security questionnaires: this page and the Backups page answer most hosting, backup, access control and logging questions. For anything else, contact Freedam support.
• Your own responsibilities: review administrators, inactive users and public links regularly. The DAM audit checklist lists what to check and how often.