Your AI Video Vendor Passed the Demo. Will It Pass Security Review?

Evaluate Golpo’s production workflow on material you are allowed to use, and build the evidence your intended deployment still needs. The finished artifact is a short explainer from a public or non-sensitive source, saved in your own storage, plus a register that marks each control as documented, contract-specific, or still open.

Golpo is built to be the complete AI explainer workflow for that pilot. You can start from an idea, a document, an approved script, or your own recording. In Prompt Mode, Golpo drafts the narration, plans the scenes, designs the visuals, narrates, syncs, and outputs a finished video. Edit script before creating video is the checkpoint where you approve the words before the render. Script Mode is how you keep wording that legal or the content owner has already approved.

This page is for the security reviewer, the procurement lead, and the team that needs the video. The producing team runs one useful pilot on permitted material. The reviewer uses the same weeks to map the data surface of the deployment you actually want. A polished demo and an unfinished questionnaire answer different questions. You can answer both.

Run a low-risk proof of value on permitted material

The pilot below is hypothetical. The source is a public help-center article, or a procedure written for the test that contains no customer, employee, health, financial, or secret data. Produce the video while procurement reviews the intended data surface. The steps are the production path you run.

1. Source. One public page or one non-sensitive procedure, with a version date. Prompt Mode drafts the narration from that source. Uploading a source gives Golpo material to draft from. You still review the draft. See Prompt vs Script Mode.
2. Settings. Canvas, with a Custom Style saved from an authorized brand image, video, or description. Reuse that named style from My Styles on the next permitted source. Turn on on-screen text from the script only so generated labels draw from the approved words. Golpo may show a subset of those words. The control is available on Canvas and Sketch. It is a label constraint, and captions remain a separate publishing step. Select a duration that fits the explanation. Two minutes is enough for one procedure.
3. Script review. Use Edit script before creating video. The content owner accepts the narration before anyone renders. If a sentence must be spoken exactly, switch that video to Script Mode. Script Mode allows about 1,050 characters of narration per selected minute. Put drawing directions in Video Instructions, not in the spoken lines. In the API, custom_script supplies narration. enable_script_only_mode generates a script and does not render that script as the video.
4. Result. Golpo outputs the video. Check names, steps, and on-screen labels against the source you approved. Export the file and store it in customer-controlled storage with the source version, the script version, and the approver’s name. Golpo generation is the production step. Your archive is the system of record. The enterprise automation guide describes that boundary.
5. One correction. If a label names the wrong control and the narration is right, frame-edit that label and review the new version. Frame editing changes visuals such as labels and images. A wrong spoken sentence is fixed in the script, then rendered again. Frame editing is on Business and higher and on Pay As You Go, and it is charged on the selected duration of that version. API frame editing is documented for Sketch, so a Canvas correction belongs in the Golpo editor.
6. One reuse. Take the next public or non-sensitive source your team already needs, and generate it in the same saved Custom Style. That second video gets its own script review and its own export record.

A redacted architecture: approval, generation, and publication stay apart

This is a pattern for the pilot, with customer systems and Golpo marked separately. Fill in your real store, region, and channel when you submit the data flow. It is a production sketch for permitted material, and it is the diagram procurement can compare with the intended deployment.

[Customer] Source store — public page or non-sensitive procedure
    → [Customer] Approval — content owner accepts the source version
    → [Golpo] Generate — dashboard, or API generate + status
    → [Customer] Script review — Edit script before creating video
    → [Golpo] Render
    → [Customer] Export — video and script stored in your storage
    → [Customer] Publish — your LMS, help center, or portal

When engineering repeats the pilot, keep that split. Your service holds the API key server-side. It calls Golpo after the content owner has accepted the source, polls status, writes the file to your storage, and your channel publishes it. Approvals, the source registry, and publishing stay in your systems. The API generates the video and reports status. Scale includes API access. Business can add a paid API add-on. API Only is a separate product with its own metering, and it does not include dashboard generation. Start with one dashboard pilot before you automate the call. Details are in the API docs, the document-to-video pipeline, and how to get API access.

Plan, duration, and credits for the pilot

A standard video uses 1 credit per selected minute. A 2-minute selection is 2 credits. The frame-edit version is charged again on that selected duration, so budget another 2 credits at the standard rate. The second source, also at 2 minutes, is another 2 credits. On Pay As You Go, Edit script before creating video charges 10 percent after the script and 90 percent after the video. Dollar amounts and length caps are on the pricing page. The Free plan is not a downloadable publishing workflow for this pilot.

• Custom Style is on Business and higher. API use of a saved style also needs API access.
• On-screen text from the script only is documented for Canvas and Sketch. In the API, set onscreen_text_from_script_only.
• Frame editing is on Business and higher and on Pay As You Go.
• Prompt Mode is available across plans. Length and advanced controls vary. Confirm the plan that includes the style you intend to evaluate.

While that video is in review, use the checklist below on the data you want the production deployment to handle.

Start with a data-flow diagram, not a questionnaire

Draw the actual proposed workflow:

source system → customer automation → vendor upload/storage
→ extraction and generation services → generated media
→ customer storage → LMS/help center/portal → end user

Annotate each boundary with data types, identities, regions, encryption, retention, and subprocessors. Include source documents, prompts, extracted text, scripts, narration, uploaded media, generated frames, final video, metadata, API logs, analytics, and support access. A generic vendor answer becomes testable only when mapped to the data you intend to send.

1. Data classification and allowed use

• Which classifications may be uploaded: public, internal, confidential, restricted?
• Are personal data, customer data, employee data, health data, financial data, source code, or secrets prohibited?
• Who approves an exception?
• Can the workflow redact or tokenize sensitive fields before upload?
• Does the vendor contract restrict use of customer content to delivering the service?
• Does any product-improvement clause include model training, human review, or evaluation?

Approve each class on its own. A marketing blog and an incident-response runbook have different risk.

2. Collection, purpose, and ownership

Request an inventory of what the service collects and why. Distinguish account and billing data from uploaded content and generated artifacts. Confirm ownership of inputs and outputs, the license granted to the vendor, and whether the vendor can use content for service improvement, analytics, safety review, or model development.

Ask how these commitments differ by free, paid, API, enterprise, and integration surfaces. A policy that applies to the main application may not fully describe an Atlassian app, API upload flow, or third-party model.

3. Retention and deletion

Ask separately about:

• Original uploaded files.
• Extracted text and intermediate scripts.
• Uploaded voices, audio, video, images, and logos.
• Generated frames, audio, podcasts, and final videos.
• Application databases and object storage.
• Logs, analytics, support tickets, and diagnostic copies.
• Backups, replication, caches, and subprocessor copies.

For each, record the default retention period, configurable options, deletion trigger, backup-aging period, legal-hold behavior, and evidence of completion. Determine whether API delete means soft delete, hard delete, visibility change, or only removal from the application.

4. Subprocessors and AI model providers

Request the current subprocessor list, purpose, processing location, data categories, transfer mechanism, and notification process for changes. Ask which AI models receive prompts, source text, images, voice, or video and whether providers retain inputs or outputs. Contractual flow-down matters: the primary vendor's promise is incomplete if a subprocessor has broader rights.

5. Encryption and key management

• Is transport protected for browser, API, upload, storage, and delivery paths?
• Which stored data is encrypted and with what service?
• Who controls and rotates keys?
• Are tenant keys separated or shared?
• Are backups and logs encrypted?
• Is customer-managed key support available if required?

Ask for the scope and the evidence behind any encryption statement.

6. Identity, access, and tenant separation

Evaluate SSO, MFA, SCIM, roles, least privilege, workspace separation, session controls, API-key scope and rotation, service accounts, offboarding, privileged support access, break-glass procedures, and auditability. For API use, ensure keys remain server-side and that logs never capture them.

Ask how the platform prevents one tenant from reading another tenant's source, job metadata, or media URL. Confirm whether generated links are public, private, signed, or guessable and how visibility settings interact with external storage.

7. Logging, monitoring, and incident response

• Which administrator and user actions are logged?
• Can customers export audit events?
• How long are audit records retained?
• What security monitoring covers uploads, access, model calls, and downloads?
• What is the incident-notification commitment?
• Which support and forensic processes may access customer content?
• How are vulnerabilities reported, triaged, and remediated?

8. Residency, transfers, and legal terms

Determine where account data, uploaded content, intermediate data, generated media, logs, backups, and subprocessors are located. Request the DPA, transfer terms, service agreement, security exhibit, breach language, deletion commitments, confidentiality terms, audit rights, insurance, liability terms, and order-of-precedence rules.

Marketing language about readiness is a prompt to request the roles, instructions, transfer terms, and contractual commitments for the actual use case.

9. Business continuity and exit

• Published uptime target and support escalation.
• Backup and disaster-recovery objectives.
• Export formats for videos, scripts, and metadata.
• How customers retrieve assets before termination.
• Deletion timing after termination.
• How production continues if the service or API is unavailable.

Store approved outputs and provenance in customer-controlled systems. The generation service is the way you produce the file. Your storage is the archive.

What Golpo documents publicly, and what buyers should still ask

Public Golpo pages cited in this table were reviewed in October 2026. Re-read them in your procurement cycle. A feature page and a privacy policy are evidence with a scope. Read each row as one of three classes:

• Documented: a public page states the control, and the statement names its surface.
• Contract-specific: treat the control as closed only when the order form, DPA, or security exhibit states it for the surface you are buying.
• Still open: the public pages reviewed here do not establish it. Ask Golpo. Leave the cell open until a document states it.

Documented in part means the public page covers a slice of the question. The rest is contract-specific or still open. Certifications are not inferred from a privacy policy or a feature list.

Topic	Evidence class	Current public evidence	Procurement follow-up
Privacy data categories	Documented in part	The Golpo privacy policy lists personal, device, cookie, approximate geolocation, and analytics data and describes service-provider sharing.	Request a service-specific data inventory covering uploaded and generated content.
Content ownership and license	Documented in part	The terms state that users retain original-content ownership and grant a limited license to process content to operate, maintain, and improve the services, subject to the privacy policy.	Clarify model-training use, evaluation, human access, and enterprise contract overrides in writing.
Transport and API authentication	Documented in part	API v2 documentation requires HTTPS and x-api-key authentication.	Request at-rest encryption, key management, API-key scope, rotation, and audit evidence.
Uploaded API documents	Documented in part	The current v2 endpoint reference says uploaded document URLs are single-use and the document is deleted from that storage after text extraction.	Ask about extracted text, temporary files, logs, backups, generated assets, and other upload types.
API deletion	Documented: soft delete	API v2 documents DELETE as soft delete.	Ask what remains, for how long, in which systems, and how hard deletion is requested and verified.
Atlassian content and retention	Documented for the Jira and Confluence apps	The Jira app privacy policy and Confluence app privacy policy say prompts and generated scripts are retained until video deletion is requested; generated media and selected attachments are also retained until deletion is requested. They say video metadata is retained for the life of the Golpo account and that a request to delete all data associated with a site or account is completed within 30 days.	Verify the current app policy, hosting, scopes, subprocessors, deletion procedure, and whether contractual terms change these defaults. The training-use sentence on these app policies is scoped to selected Atlassian content. Ask for the equivalent sentence for every other surface you will use.
Certifications and audits	Still open	The public pages reviewed for this article do not state SOC 2, HIPAA, ISO 27001, or another security certification.	Request current evidence. Absence of a public claim is unknown. It is not a certification, and it is not a finding that a certification failed.
Residency, audit logs, SSO, SCIM, incident SLA	Documented in part	The Atlassian app policies document primarily US processing and storage, no Atlassian data-residency pinning, and scoped security and incident-handling controls. The reviewed public pages do not establish organization-wide SSO, SCIM, customer audit-log export, or a contractual incident-notification SLA for every Golpo surface.	Confirm which controls apply to the purchased surface and require applicable commitments in the order form or security exhibit.

This table is a reading of public documentation as of October 2026. Public pages and private enterprise evidence can change. Re-verify both during each procurement cycle. Keep retention, training use, and deletion attached to the surface that states them. A sentence in an Atlassian app policy covers that app. The main-application terms are a different document.

A practical decision record

For every finding, record: requirement, evidence link or document, evidence date, scope, owner, risk, compensating control, decision, contract reference, and re-review date. Use four findings:

• Verified: evidence directly supports the scoped requirement.
• Partially verified: evidence covers only part of the data or service.
• Open: the vendor must answer or provide evidence.
• Not acceptable: the requirement is unmet and no approved control exists.

FAQ

Does a privacy policy prove an AI video vendor is enterprise secure?

No. A privacy policy is one evidence source. Security review also needs scoped architecture, controls, retention and deletion, subprocessors, incident procedures, access controls, contractual terms, and answers for the service you are buying.

Is Golpo SOC 2 certified?

The public Golpo pages reviewed for this guide do not state a SOC 2 certification. Ask Golpo for current audit or certification evidence. A feature list does not establish a certification status.

Does Golpo use customer content to train models?

The Jira and Confluence app privacy policies state that selected Atlassian content is not used to train Golpo AI models. The general public terms provide a limited service license and do not establish that same commitment for every Golpo surface and data type. Request a written answer and the contract language for the product and workflow you are purchasing.

What should a vendor security questionnaire ask about deletion?

Ask separately about uploaded sources, extracted text, generated scripts, audio, images, videos, backups, logs, support copies, caches, and subprocessor copies. Record the retention period, deletion trigger, backup aging, verification method, and any legal hold for each.

Can a security checklist prove compliance?

No. A checklist organizes due diligence. The decision depends on applicable law and contracts, the use case, configuration, vendor evidence, and review by qualified security, privacy, legal, and accessibility professionals.

Can the proof of value replace security review?

No. The proof of value shows how Golpo produces a video from material you are allowed to upload. Security review covers the data surface of the deployment you intend to approve. Run them in parallel. Submit the data-flow diagram, and start the pilot on permitted material in the same period.

Does the Golpo API approve or publish the video?

No. Your workflow approves the source and the script, calls the Golpo API to generate, checks status, stores the file, and publishes it in your channel. The API generates the video and reports status. Approvals and publishing stay in your systems.

Submit the data flow and start the pilot

Submit your proposed data flow, and begin an approved low-risk proof of value on one public or non-sensitive source while procurement continues. Create the pilot in Golpo. Use a Business plan or higher if the pilot includes a saved Custom Style, and confirm API access on the pricing page if engineering will call the API.

For every row marked still open, request the current security packet for the surface you intend to buy, or book a workflow discussion to walk the data-flow diagram.