Studio for Teams — Preview
Storage and privacy · Updated October 29, 2026
This separate, invitation-only preview is for trying team workflows. It is free during the pilot. Start with test orders. Personal Studio apps, Spaces, data and backups are not imported or changed. Team sign-in and storage are optional.
What is stored
We store verified email addresses (for owners, co-owners and staff who join by email), business/member IDs and names, device public keys, roles, access sessions, invitation records and activity (who did what, and when). Order details, including customer contact information, items, addresses, notes and amounts, are encrypted to each authorized device before upload. The service stores ciphertext. It can see order IDs, progress and payment status/method; those operational fields are not end-to-end encrypted. Kitchen receives no customer-contact, amount or payment data.
Devices. Each device is a separate membership with its own key. For each one we store a short device description your browser reports (for example “iPhone · Safari”), whether it is a person’s device, a station or a key backup, and when it was added. Staff who join in person with a QR code give a name only; no email is needed. A station (for example “Counter” or “Kitchen screen”) is a shared device with no personal email or account: we store the name the owner gave it, its role and its key. QR join codes are stored only as a hash, work once and expire after 10 minutes; a device that scanned one waits for the owner’s approval for up to 20 minutes. Staff and station access ends after 30 days without use.
Key backups. If an owner or co-owner turns on a key backup, the browser creates a separate backup key, seals it with the passphrase on that device (PBKDF2-SHA256 with 600,000 iterations, then AES-256-GCM) and uploads only the sealed copy. We cannot open it and never receive the passphrase. We give the sealed copy only to a browser signed in with the same verified email, at most ten times an hour (we keep the account ID and time of each request for one hour). Turning the backup off, replacing it, or deleting the workspace removes it.
Notifications. If you turn on “Notify me when closed”, your browser gives us a push address at its vendor’s push service (Google, Apple, Mozilla or Microsoft) and two keys for it. On a new order we send that address a fixed, encrypted signal with no order content; your device then checks with us and shows “New order” and the business name on the lock screen. The push service learns when a signal is sent, not what it is about. To let the page’s notification worker check, the browser keeps this device’s Team access credentials and the business name in its local storage (IndexedDB); no order content is stored there. Turning notifications off, removing the device or deleting the workspace removes the push address. Sound and vibration alerts happen only on your device and send nothing.
Sign-in codes expire in ten minutes, allow five guesses, and are removed after expiry. A hashed source address and email are used for a one-hour code-request limit; expired entries are removed by hourly cleanup. Identity sessions expire after 30 days. Infrastructure may produce standard security/access logs; codes, passphrases and authorization tokens are not intentionally logged by the Team API. We do not add team usage analytics or send team records to AI providers.
Your controls
The business owner chooses who joins and assigns the supported role; a co-owner can add and remove staff and stations but cannot delete the workspace or remove the owner. Staff joining in person are approved on the owner’s screen after both screens show the same symbols; staff invited by email must verify that email first. Each device can be removed on its own: removing a lost phone does not affect your other devices. Removing access blocks future reads/writes; information already seen or copied cannot be recalled. The owner can delete the entire workspace and its shared records and membership data. Contact service@priorstates.com for Team account deletion requests or questions; deleting a personal Studio installation does not delete a Team business.
Recovery and backups
Recover access on a new device in one of these ways: approve it from another of your devices with a QR code; or sign in with your verified email and enter your key-backup passphrase; or use a recovery file and its passphrase. Email alone cannot recover a device’s private encryption key, and we cannot reset a forgotten passphrase. The older recovery file restores the saved device itself; it does not remove another device that already holds those credentials, so prefer the key backup and remove lost devices.
The Team database has encrypted operational backups, taken hourly. They contain the same encrypted order projections and operational metadata as the database. They are kept for seven days on the service host, and a copy of each is kept for 30 days in Amazon S3 storage (AWS, US East region) in an account controlled by PriorStates; the copy stays encrypted with our backup key and is also encrypted at rest by S3, and it is private (no public access). Deleted workspace data may remain in these backups until they expire, at most 30 days. Server backups cannot replace a lost device key, and they are not offered as a self-service point-in-time recovery feature.
Limits and retention
Pilot limits per business: 30 devices (people, stations and key backups), 500 orders, 16 MiB of encrypted orders, 20 open invitations and QR codes, and 1,000 recent activity entries kept for at most 90 days; three businesses per approved owner. Owners see usage against these limits in Settings. Records remain until the owner deletes the workspace; there is no paid storage plan or production availability guarantee for this preview. Expired codes, invitations, QR codes and sessions and old activity are cleaned regularly. Verified account records remain until account deletion is requested.