Production Portal: InfoSec FAQs
At POP, we’re committed to keeping our clients’ data secure and to being open and transparent about how we process it.
To help, we’ve answered common questions on the security of the Production Portal and how we manage your data.
Platform security
Is the Production Portal secure?
The Production Portal uses Amazon Web Services, a secure global cloud provider which is ISO and CSA STAR certified.
The Production Portal is security checked and scanned on a daily basis. We also carry out frequent automated penetration testing and auditing. Any changes to the platform undergo a peer review process and every release is subject to automated testing.
Has the Production Portal been vetted?
Our information security practices have been thoroughly reviewed and approved by the information security teams of major studios and production companies, including BBC, Sky, Amazon, All3Media and AMC.
Personnel security
Do POP employees receive data protection training?
All POP employees undergo regular training in data protection, data handling and cybersecurity.
Data collection and processing
What do you do with my data?
We collect and process data on your production in order to support your use of the following features:
- Onboarding
- Contracting
- Distribution and messaging
- Timesheets
- Fit to work declarations
Do you sell my data?
We don’t - and never will - sell your data. Your data is yours, we just process it for you.
What can I tell my crew about how you process their data?
We process all personal data in line with our Privacy Policy.
Data retention and destruction
Where do you store your data?
POP stores data in the UK and the EU. We may also store data with our group companies - including our parent company, Entertainment Partners - where it is in our legitimate interest to do so for internal administrative purposes.
How long do you hold my data for?
We generally hold production data for at least the duration of your production. After your production, your data will remain on your secure portal so that you can:
- Use our cross-production reporting tools.
- Have total visibility across all of your productions.
- Maintain an audit-ready trail.
However, as the data controller, you may request the deletion of your data at any time (see below).
What happens if I leave POP - can I ask you to delete my data?
As the data controller, you can request the deletion of your data at any time, including if you wish to terminate your agreement with us. We’ll export all signed contracts and policies - as well as individual deal, start form and timesheet data - and share it with you for your records prior to deletion.
For more information on the security of the Production Portal and how it can help you to protect your data, see POP’s guide to information security.