How Filmustage Protects an Unreleased Script

In January 2014, Quentin Tarantino gave an early draft of The Hateful Eight to six people. One of the actors passed it to an agent, and within days a 146-page screenplay was circulating across Hollywood. Tarantino shelved the film and filed a copyright claim seeking damages of more than $1 million.

No firewall failed. No server was breached. A PDF moved from one trusted person to another, and then it kept moving. That is the risk any pre-production platform actually has to answer for — and this article sets out how Filmustage answers it, what our credentials do and do not prove, and where you can verify every claim without taking our word for it.

Where scripts actually leak

Unreleased material leaks in three ordinary ways: someone forwards a file they were trusted with, a copy sits in a shared folder nobody has audited in a year, or an attacker signs in with a valid credential and walks through the front door. Perimeter breaches are the rarest of the three, and even those only cause damage because the material inside had no controls on it.

The industry's own data says the same. In April 2026 the Trusted Partner Network — the content security initiative owned by the Motion Picture Association — published the TPN STAR Report, the first analysis of large-scale assessment data across the content supply chain. In the first quarter of 2026, TPN issued more Security Alerts than in the whole of 2025. The recurring weaknesses were compromised credentials, inconsistent multi-factor authentication, insecure cloud configuration, and slow patching. The worst-performing control areas were vulnerability management, cryptography, endpoint hardening, and access management.

TPN president Terri Davies described the finding as a persistent disconnect between how secure organizations believe they are and how their controls perform day to day. That gap, not a shortage of technology, is where pre-release material is lost — which is why the questions worth asking a vendor are operational rather than ceremonial.

What SOC 2 Type 2 and TPN actually prove

Two credentials come up in nearly every studio vendor review, and they prove different things.

SOC 2 Type 2 means an independent auditor examined our systems across a period of months and confirmed that controls — access management, monitoring, incident response — operated consistently over that whole window, not on the day of the audit. The report and the letter of attestation are both available on request.

TPN is the Motion Picture Association's content security program. It maintains the MPA Content Security Best Practices and runs the registry studios consult when sourcing vendors. Here is the part worth stating plainly, because plenty of vendors blur it: TPN's own FAQ says it does not certify facilities. It provides self-reporting and assessment functionality, and content owners use that data to reach their own risk-based decisions. Since the questionnaire for MPA Content Security Best Practices v5.3.1, the program runs on four tiers — Blue (self-assessed, published on the platform), Silver (assessed by an accredited third party, with a remediation plan), Gold (all best practices remediated and reviewed by TPN), and Gold Star (best practices plus additional recommendations).

So when any vendor tells you it is "TPN certified," it is describing something the program says does not exist. Our own status is Blue Shield, TPN's label for that entry tier, and what it honestly tells you is narrower and still useful: we answered the MPA questionnaire in full and published those answers where content owners can read them. We renew that self-assessment every year, so what you read on the TPN platform reflects our current environment rather than a snapshot from three years ago. Independent verification comes from two places instead: a SOC 2 Type 2 audit, and penetration testing carried out yearly by an independent security firm, with findings tracked through to remediation. Both reports are available under NDA.

The security review checklist, and our answers

These are the questions a studio or production security review puts to a software vendor. Run them against anyone you are evaluating. Our answers are below, each with somewhere you can check it.

Traceability: the control most tools skip

Encryption protects a file from strangers. It does nothing about the person who was legitimately given access and then forwarded the PDF — the exact failure mode of 2014. Traceability closes that gap: every copy carries the name of the person who produced it, so a leaked page answers the only question that matters after a leak. Not how did this get out, but who.

In Filmustage this is content protection, configured by a project or organization owner:

• Export access — allow all exports, restrict to PDF only, or block exports entirely
• Forensic watermark — tiled across PDF exports and across the on-screen view in the browser. It carries the identity of the person looking at the file or exporting it, next to an optional custom notice such as CONFIDENTIAL — do not distribute . Every copy is therefore individually attributable: two people opening the same script see two different documents
• PDF lock — restrict editing and copying in exported files, with a password-to-open option available at export time

Settings inherit downward across three levels — team, project, and individual collaborator — and whoever exports can tighten a single export further on top of what the owner set. A director can hold looser settings than a location scout on the same project, without anyone maintaining two versions of the script. Content protection is available on plans from $149/month, or on any paid plan active for three or more consecutive months.

The practical consequence is worth stating plainly: there is no such thing as an anonymous copy. A page photographed on a phone and sent to a journalist still carries the name of whoever exported it, and the export date narrows the window to a single day. That changes behavior before it ever has to be used as evidence — people handle a document differently when it has their name on every page.

How to verify all of this yourself

Nothing above should be taken on trust, which is the point of publishing it.

1. Read the controls. The Trust Center lists every control individually across infrastructure, organizational, product, internal procedures, and data privacy.
2. Read the commitments. The Help Center security documentation covers encryption, storage, and the model training position. The Privacy Policy defines Script Data and sets out retention.
3. Request the evidence. The SOC 2 Type 2 report, letter of attestation, our yearly penetration test reports, and our internal policies are available under NDA through the Trust Center, or by writing to [email protected] .
4. See the controls working. Ask for a walkthrough of content protection on a live project — watermark, export restrictions, and inheritance are quicker to judge in five minutes than in any document.

The bottom line

A security review is not looking for a logo. It is looking for evidence that controls run every day and that a leaked page can be traced back to a person. The 2026 industry data is blunt about this: the failures are operational — credentials, access, patching — not exotic.

So the honest version of "studio-grade" is boring and checkable. Independent audit where independence matters. Published self-assessment where the standard is a questionnaire, described as exactly that. Watermarking and export control where the real risk is a trusted person with a PDF. We would rather be precise about which of those we have than round it up, and everything above is written so you can confirm it without asking us.