Client files, source assets, and proprietary project materials are stored within partitioned, access-controlled repositories maintained directly by our Technology department. Access is restricted strictly to active team members assigned to your brief, with external sharing disabled by default.
File ingestion and initial sorting
When you supply project files, assets, or briefing documents, they enter our ecosystem through the client portal or via direct exchange in the Ask Xylo chat interface. Files should not be delivered through unmonitored public file-transfer links or social messaging channels.
Once received, the sequence runs as follows:
1. Receipt and verification: Operations & Client Services logs the delivery against your active project ticket during standard studio hours (Monday to Thursday, 09:00-17:00 GMT). 2. Security scanning: Files are automatically inspected for known vulnerabilities, corrupted archives, and unauthorised scripts. 3. Directory assignment: The Technology department provisions an isolated project directory. Access permissions are granted exclusively to the Creative and Technology personnel assigned to that deliverable. 4. Confirmation: Operations & Client Services confirms receipt via the Ask Xylo chat, flagging any corrupted files or missing production elements.
Storage architecture and access tiers
We do not operate a generalised pool where all studio staff can view all client data. Storage permissions are segmented across three clear tiers:
* Production storage (Active): Houses raw footage, high-resolution branding kits, databases, and source code. Accessible solely by the specific Creative and Technology team members assigned to execute your brief. * Operational storage (Administrative): Contains signed agreements, project briefs, billing notes, and schedule outlines. Managed by Operations & Client Services. Creative teams have no direct write access to this tier. * Cold archival (Post-completion): Read-only snapshots taken once final sign-off is logged and remaining balances are settled. Archived data is sealed against editing and placed in segregated, long-term digital storage.
All data at rest is encrypted using standard industry ciphers, and production directories do not inherit open public links. Even within internal studio tools, access requires identity verification managed centrally by Technology.
What clients must supply
To ensure your assets remain protected and easily traced, you must follow clear submission hygiene:
* Structured archives: Supply source files in standard ZIP or TAR containers with plain, descriptive file naming that omits internal passwords or personal data in the title string. * Restricted credentials: If your project requires providing access keys, API tokens, or server logins to the Technology department, do not post them in open chat. Use expiring, encrypted credential-sharing services or the dedicated credential fields within the portal. * Clear ownership declarations: State any third-party confidentiality constraints or embargo windows in writing during the initial brief so our team can apply appropriate tagging to the directory.
Data retention and disposal cycles
Because of the resource demands of media production and code repositories, the studio adheres to a structured retention timetable:
* Active production: Retained with real-time operational mirrors for the duration of the project milestone. * Project close (0 to 30 days): Raw working assets remain in production storage to allow for warranty adjustments and routine asset requests handled through Ask Xylo. * Archival (31 to 90 days): Files are condensed into cold storage. Project branches and intermediate render scratch disks are purged. * Final deletion (Past 90 days): Unless your bespoke quote or package scope specifies an extended archival agreement in writing, scratch files and unreleased interim drafts are securely deleted. Final approved masters remain archived for record-keeping.
Incident handling and access revocation
If a security anomaly, accidental over-sharing, or external credential compromise occurs, our response procedure begins immediately upon detection or receipt of a client notice via Ask Xylo:
* Immediate lock: The Technology department isolates the affected project folder, invalidates all active session tokens, and severs external sync endpoints. * Audit review: Operations & Client Services reviews file access logs generated across the preceding 72 hours to trace any anomalous downloads or permission changes. * Remediation: If an individual team member departs or transitions off a project, their directory access is revoked within one working hour.
Secure handling checklist
Before transferring confidential material to Xylora Studios, complete these operational checks:
* Upload files directly through the client portal or Ask Xylo chat rather than unverified third-party hosts. * Confirm all passwords or API secrets are sent via temporary, self-destructing links. * Ensure you hold the necessary rights or sub-licences to transfer confidential third-party materials to our studio. * Flag any non-disclosure agreements or embargo release dates clearly in your initial project documentation.