Security
Unreleased music is sensitive. Here is exactly how HitHat handles it.
Private by default
Nothing you upload is reachable until you create a share link. Audio lives in a private bucket and is only ever served through short-lived signed URLs.
Links you control
Share links are long random tokens. Each one can be password-protected, set to streaming-only, given its own name per recipient, and switched off instantly.
Isolation at the database
Every table is protected by row-level security tied to your account. Guests never query the database directly. A server function validates the link and password on every request.
Encryption
Data is encrypted in transit (TLS) and at rest (AES-256). Link passwords are hashed with bcrypt and never stored or returned in plain text.
Your audio, untouched
We store the exact bytes you upload and stream that same file. No transcoding, no bit-depth changes, no dither surprises.
Right to be forgotten
Delete a project and its audio, comments, and analytics go with it. Delete your account and everything is removed.