Trust
Who can see your data
Silo is built by one person: me, Ben Colson. I spent the first six years of my career as a software developer, mostly building competition draw systems and web apps for financial services companies. These days I work as a photographer, DoP and DIT on commercials, trading as Colson Studio Ltd. So the obvious question is what stops me reading your rates, your clients and your bookings. Here's the straight answer.
Silo's encryption
Silo protects your sensitive data with end-to-end encryption tied to your account.
When you log in, your browser takes your password, mixes it with a unique salt and turns it into your encryption key. That all happens on your device. The key is never sent anywhere or stored anywhere. Your password does reach my server when you log in, because that's how Silo knows it's you, but it's only stored as a one-way hash. You can't get your password or your key back out of it. If you sign in with Apple or Google, Silo will ask you to set a password too, because without one there's nothing to make your key from.
That key doesn't encrypt your data directly. It unlocks a second, random key, and that one encrypts your jobs, clients, expenses and invoices using a modern, standard cipher. Having two keys means that when you change your password, Silo just re-locks the second key instead of re-encrypting everything you've ever entered. My servers only ever hold the scrambled version. It gets unscrambled on your device, so I can't see it, and neither could anyone who stole the database.
A few things can't work that way, and you should know which. Dates and statuses stay readable so the app can sort and group your jobs without your key. Anything created by calendar sync or by a forwarded call sheet is readable too. Both happen on the server when you're not logged in (a call sheet might land in your inbox while you're on set), so your key isn't there to use. That data is encrypted with the app key instead: a key the Silo app itself holds, rather than one made from your password. It's safe if the database is stolen, but not hidden from me. Client names and billing addresses fall into the same group, because the server needs to read them to match calendar entries to the right client and to print them on your documents.
End-to-end encryption is something you choose to switch on. Until you do, your figures are still encrypted at rest, just with the app key rather than yours. Everything below about what I can't see applies to accounts that have it turned on.
What doesn't live on Silo's servers
Your call sheets. When you forward a call sheet to your Silo address, Silo reads it, pulls out the useful details, matches it to the job and saves it to your own Google Drive, OneDrive or Dropbox. The dates, times and locations are recorded, but the document itself doesn't stay with me. If you haven't connected a storage provider, the file is read and then thrown away. The one exception is if the upload to your storage fails. Then Silo keeps the original on its own disk and retries every day until it goes through, because losing a document you were counting on would be worse. Silo will tell you when that happens. Whatever details are kept in Silo's database are encrypted.
The rest of your cloud storage. Silo only asks Google Drive, OneDrive and Dropbox for access to files it saved or created itself. It can't see anything else in your drive, and that limit is enforced by Google, Microsoft and Dropbox, not just by me.
What I can technically see
Not much. The app can read some basic job details, locations, calendar dates and event names at any time. Those are encrypted with the app key.
Your numbers (day rates, kit rates, expenses, invoice and quote prices, discounts) are encrypted with your password-based key once you've switched encryption on. They can only be decrypted in your session. If there were ever a breach, whoever got the data would get ciphertext, not your numbers.
As above, client names and billing addresses are encrypted with the app key rather than yours, because the server has to read them to match calendar entries and to redraw documents you made months ago. So they're safe from a stolen database, but not from me.
Three things limit who can get into that database:
1. There's no tool for browsing your data. My support tools show account status, connection health and errors. They don't show job names, clients or rates. To read your content I'd have to deliberately query the production database by hand and decrypt it with the app key. Even then, on an account with encryption on, I'd only see who you're shooting for and when, not what you charged.
2. Every direct database session is logged. I only go into the production database directly to repair data or recover from a disaster, and every session is audit-logged.
3. It's in the contract. The Data Processing Agreement commits me to these rules.
I never use Silo's data for my own freelance work, to set my rates or to find clients, and I never analyse rates, clients or bookings across users. Your day rate is not my market research. Apart from the few suppliers listed below, who only handle data to keep Silo running, nobody else gets your data.
What I will never do
- Sell your data or share it with advertisers
- Train AI models on your job data, mine or anyone else's
- Build "market rate" reports from what users charge (with encryption on, I couldn't read your rates anyway)
- Look at your account without your permission, and only then to fix a problem you've asked me about
Third parties
The full list of companies that process data for Silo is short, and it's in the Privacy Policy:
- Hetzner, for hosting (Germany)
- Google's Gemini API, to read call sheets, receipts, serial photos and WhatsApp messages, to file call sheets and calendar events to the right job, to match clients to your accounting contacts, and for small helpers like expense categories and CSV column mapping. The Privacy Policy lists exactly what each one sends.
- Meta, through the WhatsApp Business Platform, to receive paperwork, job details and receipts sent to Silo's WhatsApp number and to send our replies
- Resend, for email
- Sentry, for error monitoring
- Stripe, for billing
- Cloudflare, for traffic security
- Apple, whose iCloud Mail hosts the [email protected] mailbox, so anything you email me is stored there
That's all of them. Everything else (Drive, Dropbox, OneDrive, Xero or FreeAgent, your calendars) is your own account. You connect it, and you can disconnect it.
Found something?
If you find a security issue, email [email protected]. I read that inbox myself, so you'll get a real reply. And if Silo ever has a breach that affects you, you'll hear about it from me directly, not from the news.
Questions about any of this? Email [email protected]. The legal versions are the Privacy Policy and the DPA. This page is the plain-English version, but I hold myself to both.