Security & privacy basics

Unreleased songs are the most confidential thing a publisher has. These are the rules Catalyst is built on. They're enforced in the product's code and database, not just in policy.

Your workspace is yours alone#

• Every song, writer, file and playlist belongs to exactly one workspace.
• The database itself checks that you're a member of a workspace before returning any of its data (row-level security), on every table. Each table ships with a test proving one workspace can't read another's data.
• Catalyst decides which workspace you're working in from your own membership, never from anything your browser sends.

Private audio and files#

• Audio, images and delivered emails are kept in private storage. Nothing is publicly addressable.
• Audio plays and downloads only through short-lived signed links created for that request, after Catalyst has checked you're allowed to hear it.
• Original files are never modified or overwritten. Replacing a recording keeps the original in storage.

Share links show only what they grant#

• A share link opens one song or one playlist, nothing else in your workspace.
• Expiry and revocation are checked every time the page is opened and every time a file is played or downloaded. A revoked link stops working immediately.
• The page shows titles, version types, lengths, artwork, and writer names only if you allowed them. Never lyrics, notes, splits or status.
• Downloads work only when the link allows them.
• View and play counts are per link. Catalyst doesn't record who opened a link, their IP address or their location. See Views, plays and downloads.

Nothing silently lost#

• Every change to a song, writer or publisher is recorded with who made it, when, and the value before and after, including changes from imports, deliveries and analysis.
• Deleting a song, version, writer or playlist hides it; it isn't erased.
• Splits that don't add up are saved and flagged, never thrown away.

AI proposes, people decide#

• Nothing the AI reads from an email reaches your catalog until a person approves it, or until it clears an auto-approve bar an owner set (and even then, never with a writer you don't already have).
• AI never overwrites something a person entered: a BPM or key you typed, a writer you picked in a review.
• Unreleased music and lyrics are sent only to the services Catalyst is built on, and only for the feature you're using. Bulk AI work shows its estimated cost and waits for your confirmation.

Signing in#

You sign in with Google or with a one-time link sent to your email. Catalyst never asks you to create a password. Only owners can invite people, and an invitation works only for the email address it was sent to.

Questions#

For anything this page doesn't answer, email support@joincatalyst.io.