Your music business, priced for musicians.

Business securityAvailable on request

Your workspace, encrypted under a key of its own.

Contracts, reviews, signatures and files are sealed with AES-256 under a key that belongs to your workspace alone. Take a copy of everything, still encrypted, and open it offline with a key only you hold.

A key of its own

Your workspace has one encryption key, made for it and used for nothing else. Every contract, review, signature and uploaded file is encrypted under it with AES-256, so a copy of our database or storage is unreadable without that key.

Sealed to its place

Each field and file gets a fresh key of its own and is tied to the document it belongs to. Move a sealed value to another document or another workspace and it will not open.

The master key stays with Google

Your workspace key is itself wrapped by a Google Cloud KMS key that cannot be exported, and every wrap is bound to your workspace.

Staff access needs more than a login

WALDHORN.AI staff cannot open an encrypted document without a separate offline admin key. Any exceptional access also needs passkey verification and a documented case, and is logged.

A Recovery Kit only you hold

You make a key in your own browser and keep it in a file under a passphrase only you know. We receive only its public half.

Read it on a plane

Download your workspace as an encrypted archive and open it on your own computer with the network switched off. The page that opens it is not allowed by your browser to contact any server, and you can test that by disconnecting first.

Nothing changes in how you work

Sharing, negotiation, e-signature and verification by QR code work exactly as before.

For your security review

The facts a security team asks for, including what is not covered.

Cipher

AES-256-GCM. Each field and file is sealed under its own key, derived from the workspace key with HKDF-SHA256, and its whole header is authenticated.

Key custody

The workspace key is wrapped by a Google Cloud KMS key, by two offline admin keys and by your Recovery Kit. If the Google key were ever lost, the admin keys restore every workspace key; nothing is re-encrypted.

Staff access

An offline admin key, passkey verification, an open case and an audit record for every opening. The page that opens a document runs under a strict content security policy.

Your key

A P-256 key pair made in your browser. The private half never leaves it and we keep only the public half. Replacing a Recovery Kit does not change the workspace key.

The archive

Ciphertext copied unchanged; our servers never open it to make the archive. Download links last 15 minutes and are issued only after an audit record is written. It is a copy as stored, not a snapshot of one instant.

Backups

Sealed fields stay ciphertext in every backup. Deleted copies live in storage and backups for up to 35 days, so a workspace is called Encrypted only after that.

Not encrypted

Your account and sign-in email, billing and credits, the list of people in a workspace, and a document's type, status, dates and size. A document's text goes to the language-model service when you ask for a review or a draft, and an email we send for you goes through our email service.

Our servers

They can use your workspace key to open your workspace for you while you work. Encryption protects what is stored, not what is in use.