Backlit
Trust Center
Last reviewed: November 2, 2026
Backlit builds the systems that run large live productions: casting, scheduling, communications, and, when people are paid through us, onboarding and payroll. This Trust Center is for clients and the security teams who review us. The Privacy Policy covers what we collect and the choices a person has. The Terms of Service are the agreement for using the service.
For a security questionnaire, a data processing addendum, or a more detailed overview, write to help@getbacklit.com. Security-related reports go to the same address.
Overview
Customer data is hosted in the United States. The application and database run on DigitalOcean. Files are stored in Amazon S3. Traffic to the site uses HTTPS. Connections between the application and the database require TLS. Objects in file storage are encrypted at rest, and that storage does not allow public access.
The platform holds the information needed to cast, schedule, and communicate with people on a production. Where payroll is in use, that includes tax and bank details. Where a background check is required and authorized, screening status is stored with the record.
Security controls
Access control
Access inside the application is limited by organization and by the work a person is assigned to. Access to hosting, the database, and cloud storage is limited to staff who need that specific set of systems for their work. Those accounts require multi-factor authentication.
Encryption
Data in transit is protected with TLS. Browsers are instructed to keep using HTTPS. Files are encrypted at rest in object storage. Government identifiers, tax withholding fields, and bank account details are encrypted by the application before they are written to the database. Passwords are stored as one-way hashes. Encryption keys and application secrets are held separately from the database. Credentials for connected services are encrypted before they are stored.
Application protections
Requests that change data are checked against cross-site request forgery. The application sets browser security headers that limit framing and how scripts load. File downloads are authorized by the application before an object leaves storage. Inbound webhooks from connected services are authenticated.
Logging and monitoring
We keep a detailed audit trail of authenticated activity in the product, including creates, updates, and deletes of customer records and other significant actions. Each entry records who acted, what they did, when it happened, whether it succeeded, and enough context to place the action (including request identifiers and source IP). Those entries are append-only. The application does not update or delete them.
Application errors are monitored so we can find and fix problems. Passwords, tokens, government identifiers, bank fields, and contact details are filtered from application logs. Sensitive field values are not written into the audit trail.
Security reports
If you find something security-related that our team should know about, send it to help@getbacklit.com. We look into reports and follow up with the people who need to know.
Subprocessors
These companies process information because the product uses them. Payroll, HR sync, and background screening apply only when that feature is enabled for a client.
| Provider | Role | Data involved |
|---|---|---|
| DigitalOcean | Application hosting and Managed MySQL (United States) | The running application and the database |
| Amazon Web Services | Object storage (United States) | Uploaded files |
| Postmark | Transactional email | Recipient addresses and message content |
| Twilio | Text messaging | Mobile numbers and message content |
| Zeal | Payroll | Employment and pay information, when payroll is enabled |
| Rippling | HR and time sync | Worker, time, and leave records, when connected |
| Yardstik | Background screening | Identity information required for a check, and the result, when screening is required and authorized |
| Honeybadger | Application error monitoring | Error reports |
| ip-api.com | Approximate sign-in location | Sign-in IP address |
Common questions
Where is customer data stored?
In the United States, on DigitalOcean and Amazon S3.
Who can access customer data?
People using the product see only what their organization and assignments allow. Access to hosting, the database, and cloud storage is limited to staff who need those systems for their work, and those accounts require multi-factor authentication.
How is sensitive data protected?
TLS protects data in transit. Files are encrypted at rest. Government identifiers, tax fields, and bank details are encrypted before they are stored. Passwords are hashed. Encryption keys sit outside the database. Sensitive fields are kept out of application logs and out of the audit trail.
Do you keep audit logs?
Yes. Authenticated activity and changes to customer records are written to an append-only audit trail with actor, action, time, outcome, and request context.
Do you use subprocessors?
Yes. The table above lists them. Optional services such as payroll, HR sync, and background screening are used only when a client enables them.
Is a data processing addendum available?
Write to help@getbacklit.com and we will send the terms that apply.
How do we send a security questionnaire?
Email it to help@getbacklit.com. Include the company name and the deadline you are working against.
How do we report something security-related?
Email help@getbacklit.com with enough detail for us to understand and assess it. Do not include passwords or live secrets in the message.
Where is retention and privacy covered?
In the Privacy Policy.
Questions about this Trust Center go to help@getbacklit.com.