Cloud Infrastructure Security
Skies protects its core cloud environment through recognized compliance frameworks, strict privilege isolation, and end-to-end network encryption.
- The Skies cloud infrastructure aligns with ISO and SOC 2+ frameworks as well as global privacy regulations.
- All data traffic within the Skies infrastructure is safeguarded using SHA-256 encryption paired with RSA encryption.
- All data transfers between client applications, management servers, LucidLink storage, and archive buckets take place over secure, encrypted TLS connections.
- We conduct continuous automated control monitoring and compliance tracking across our cloud environment via a third-party trust management platform.
Content Security
Media assets and streaming proxies are protected throughout their lifecycle using zero-knowledge storage, localized encryption, and strict access controls.
- We utilize the LucidLink storage platform, which features zero-knowledge encryption. More Information on Lucidlink’s security.
- Strawberry Skies servers generate streaming-optimized preview proxies pre-encrypted using AES-128, with each asset assigned a unique pair of encryption and decryption keys.
- Encrypted content is served via CDNs in the requester’s region, and regional geo-blocking of caches is fully supported.
- Strawberry supports watermarking on all proxy files accessed via Skies.
- Real-time automated event notifications keep users informed of critical asset lifecycle events, including metadata changes, proxy re-encodes, deletions, and archive retrievals.
Authentication Security
User identity and system access are governed by strict password policies, directory integration, and modern Single Sign-On standards.
- Robust password practices are mandatory for all Skies users.
- All passwords are stored as cryptographic hashes on the Strawberry system.
- Strawberry supports Single Sign-On (SSO) via the OpenID Connect (OIDC) protocol. Supported identity providers include Okta, Microsoft Azure AD / Entra ID, Google Workspace, Auth0, Amazon Cognito, and any certified OIDC provider.
- Authorization is governed by Role-Based Access Control (RBAC). User accounts are assigned specific roles with over 70 individually configurable feature permissions, while project-level access is restricted through Team memberships.