Lookbook is a continuity and department-management tool for film/TV Makeup, Hair, Wardrobe and Prosthetics departments. It handles sensitive material — photographs of actors in various states of makeup and costume, schedules, and crew information — and is built accordingly.
Trusted Partner Network
Lookbook holds TPN Blue Shield status. The Trusted Partner Network is the Motion Picture Association's content-security program, the common standard the major studios and streamers use to vet the companies that handle their content. A Blue Shield means we completed TPN's Best Practices Questionnaire against the MPA Content Security Best Practices and documented our controls on the TPN+ platform, where studios can review them. The next tier, Gold, adds verification by an accredited TPN assessor.
Security reviewers can request our questionnaire answers and supporting documents, the risk register included under confidentiality, at hello@lookbookhmw.com.
Where the data lives
- On device: each crew member's phone keeps an encrypted-at-rest local copy (standard iOS/Android storage encryption), so the department keeps working with no signal on location. Photos never leave the app's private storage area.
- In the cloud: data syncs through Supabase (built on Amazon Web Services), encrypted in transit (TLS) and at rest. Photos are stored in a private bucket — there are no public links; every download requires a signed, expiring URL issued only to authenticated members.
- In the chat: on productions that turn it on, chat text is sealed end to end, and the keys follow the room. Every room has its own key — the Makeup room, the Hair room, the thread between two departments, each private line — and only the members of that room ever hold it. A Hair phone cannot read a Makeup message, even one it somehow obtained, and a sealed message carries its room inside its signature, so it cannot be re-filed into another room. When someone leaves a room (a chair change, a last day), that room's key rotates: they keep what they read, not what comes next. The keys live on the crew's phones and the server relays what it cannot read. With no service, the trailer's Local Net carries the same sealed messages phone to phone, and a phone may join only after proving a key the crew has already seen.
Found a problem, or production content where it should not be? Report it here, anonymously if you prefer.
Who can see what
- Per-production isolation, enforced by the database. Every record is bound to a production, and row-level security rules in the database itself — not just the app — make records invisible to anyone who is not an active member of that production. A crew member on Show A cannot query, guess or stumble into Show B's data.
- Rooms do not cross. Each department's chat room is walled twice: the database hands a room's messages only to that department's members, and on sealed productions the room's key is held only by them. Makeup cannot read Hair; Hair cannot read Makeup.
- Membership is scheduled. Day players are given a last working day; when it passes, their access lapses automatically. Nothing needs to be remembered or revoked by hand. On Locked productions, the show's photographs and paperwork also leave their phone a week after that last day; their kit and face charts stay theirs.
- Roles. Only the production owner and department heads can invite crew, change roles, or set access dates. Invites are short-lived codes (30 days / limited uses).
- Accounts are individual email sign-ins (Supabase Auth). No shared logins.
Security levels — matched to the show
Not every production runs the same policy, so each production sets its own security level in the app. Department heads choose it; it applies to the whole crew immediately.
- Standard — call sheets are visible to the whole department. Right for most shows.
- Restricted — call-sheet documents are visible to production admins only. Every crew member still gets their own call time (with alarms), the day's locations, and their scenes — the workday works without the sensitive document circulating.
- Locked — Restricted, plus retention: call-sheet documents are purged automatically 24 hours after their shoot day, from the cloud and from every crew phone's cache, matching studio retention policies. Continuity records — the department's own work product — are unaffected.
Current enforcement, stated plainly: per-production isolation, membership expiry and the Restricted/Locked call-sheet rules are enforced by database row-level security — on a Restricted or Locked production, a non-admin querying the API directly gets no call-sheet records back, independent of the app. Restricted and Locked productions also keep an audit trail: every open, share and scene-read of a document is logged (who, what, when), readable by production admins only. On Locked productions, every screen that shows the production's photographs or paperwork refuses screen capture, on Android and iOS, and a Locked production never opens in the web app: a browser cannot refuse a screenshot and would keep a copy on the computer, so Locked productions are phone and tablet only. Still in development, stated so reviewers never discover gaps themselves: viewer-name watermarking on sheet views (requires our in-app document viewer), and application-level encryption of the on-device database on top of OS storage encryption.
What the vendor can see
- What reaches an AI provider is text a crew member asks to have read: call-sheet and script prose, the background wrangler's list, a receipt, a lunch menu, or a question typed to support. It is sent for reading only, results are returned to the production, and the text is not used for model training under the provider's enterprise terms. Schedules, the day-out-of-days and background breakdowns are read by Lookbook itself from the PDF's own layout — no AI provider ever sees them. No continuity photos are ever sent to AI providers. (The current AI subprocessors are named in the Privacy Policy.)
- AI reading is a granted power, not a default: department heads and keys hold it; other crew use it only after their department head turns it on for them, and every call is capped per person per day.
- Usage metering records counts — who used which feature, when, how much text, and when the app was opened — never content.
Ownership & wrap
- The production owns its data. At wrap, the department exports the Wrap Archive — the complete continuity book (profiles, looks, product records, per-scene entries and photos) — as a deliverable, and can additionally export the raw data.
- Deletion on request: a production's records can be permanently removed after wrap.
Email-in paperwork
- Each production can receive its paperwork by email at a dedicated address — the nightly call sheet from the distro, and the background wrangler's list, which the department shows the wrangler as a QR code to scan. The address is an unguessable random token — never the show's name; any member of the department may show the QR, and only its admins manage the address and its allow-list.
- An optional sender allow-list adds a second lock: only mail from the production office's domain (or named addresses) is accepted.
- Incoming webhooks are cryptographically signed by the mail provider and verified before anything is stored; received PDFs land in the same private, production-scoped storage as photos (signed, expiring URLs only).
- Nothing applies automatically: a crew member always reviews the paper in the app before reading it in.
Operational safeguards
- All sync writes are authenticated and validated server-side; conflicting edits resolve deterministically (last-writer-wins with server timestamps).
- Daily database backups are taken for licensed productions.
- Payment handling is by Stripe; Lookbook never stores card numbers.
See also the Data Processing Addendum — written so a production's legal and security teams can sign off quickly. We will also answer reasonable written security questionnaires and execute a production's standard NDA on request.
Questions: hello@lookbookhmw.com