About this assessment

This page summarises the risk assessment of MediaTuig B.V., trading as New Way Work (“New Way Work” or “we”). In this document, “you” means our client. The assessment covers our editing service, the systems we use and our editing team on Lombok, Indonesia. The editors are employed by PT Starianti Administrative Center (“PT Starianti”), our sub-processor. The measures mentioned here are described in more detail in our information security policy. We leave out configuration details.

Assessment date: 24 September 2026. Next review: within 12 months, so by September 2027 at the latest, and sooner after a significant change or an incident.

We refer to three workflows:

• Cloud workflow: you invite us to a project library in your own Blackmagic Cloud account. Only proxy files sync to our editors; your originals stay on your own storage.

• Upload workflow: you upload source footage to our file exchange, up to 20 GB per project.

• On-site option: your footage stays on a Mac mini at your office, and our editors work on it through encrypted remote desktop.

Method

We rate each risk for likelihood and impact on a three-level scale: first before measures, then with the measures in place today (the residual risk). Planned measures do not count towards the residual rating.

Likelihood:

• Low: not expected in a typical year.

• Medium: could happen in a typical year.

• High: expected to happen at least once in a typical year.

Impact, for you, for the people in your footage and for our service:

• Low: minor inconvenience or a short delay, with no exposure of confidential material.

• Medium: noticeable harm, such as a significant delay, extra work, or limited exposure of material with low sensitivity.

• High: serious harm, such as exposure of confidential or sensitive footage, harm to people in the footage, loss of material that cannot be replaced, or regulatory consequences.

The overall risk follows from the combination:

• Low: low likelihood with low or medium impact, or medium likelihood with low impact.

• Medium: medium likelihood with medium impact, low likelihood with high impact, or high likelihood with low impact.

• High: high impact with medium or high likelihood, or high likelihood with medium impact.

The ratings are the judgement of the founder, who owns our information security policy, based on our set-up on the assessment date.

Summary

With the measures in place today, four risks remain at medium: unauthorised access to client footage, ransomware or server compromise, account takeover, and dependency on key people and suppliers. All other risks are low. The open actions at the end of this page mainly target the first three.

Risks

1. Unauthorised access to client footage

• Description: someone without permission views or copies your footage, for example through our servers, the file exchange, or an editor’s device that is lost, stolen or misused.

• Before measures: likelihood medium, impact high, risk high.

• Measures in place: the cloud workflow keeps originals with you; the 20 GB cap limits what we hold; footage is deleted after delivery; single sign-on with access on a need-to-know basis; non-admin editor accounts; TLS (HTTPS) on all our services; firewall, fail2ban and key-only SSH on our servers; encrypted remote access; confidentiality obligations in every team contract.

• Measures planned: enforce multi-factor authentication (MFA) for every account; automate deletion after delivery.

• Residual risk: likelihood low, impact high, risk medium. Proxies are lower in quality but show the same content, so a leak would still have a high impact.

2. Transfer of personal data to Indonesia

• Description: our editors work in Indonesia, which has no EU adequacy decision. Without safeguards, the transfer would not meet GDPR requirements, and the people in your footage could lose effective protection, for example against access by public authorities without equivalent safeguards.

• Before measures: likelihood high, impact medium, risk high.

• Measures in place: a data processing and transfer agreement with PT Starianti that incorporates the EU Standard Contractual Clauses (SCCs), Module 3 (processor to processor); the transfer impact assessment summarised below; the cloud workflow and on-site option, which keep originals out of Indonesia; encryption in transit; deletion of working copies after delivery.

• Measures planned: confirm that the signed SCCs are on file; document the full transfer impact assessment and review it every year.

• Residual risk: likelihood low, impact medium, risk low. This rating depends on the SCCs being signed and in force.

3. Loss or corruption of footage

• Description: footage or project work is lost or damaged through hardware failure, sync errors or accidental deletion.

• Before measures: likelihood medium, impact high, risk high.

• Measures in place: your originals stay with you; in the cloud workflow every asset the editors use syncs automatically, so work does not depend on a single machine; deleting source files on managed render machines requires an administrator password; our servers are backed up with encryption at a separate provider.

• Measures planned: none at this time.

• Residual risk: likelihood low, impact medium, risk low.

4. Ransomware or server compromise

• Description: an attacker exploits a weakness in one of our self-hosted tools or servers to steal data, encrypt it or take services offline.

• Before measures: likelihood medium, impact high, risk high.

• Measures in place: a weekly update round; periodic security scans; a firewall with hardened rules; fail2ban; SSH with keys only; single sign-on for internal tools; periodic rotation of secrets; encrypted off-site backups at a separate provider; logs to investigate incidents. In the cloud workflow, originals are never on our servers.

• Measures planned: enforce MFA for every account; automate deletion, so that less footage is held on our servers.

• Residual risk: likelihood low, impact high, risk medium. We host many of our own tools, so we carry this risk ourselves instead of relying on a large platform.

5. Account takeover

• Description: an attacker obtains a team member’s login details, for example through phishing or a reused password, and signs in as that person.

• Before measures: likelihood high, impact high, risk high.

• Measures in place: single sign-on, so accounts are managed and blocked in one place; MFA available and being rolled out as mandatory; access limited by role; non-admin editor accounts; SSH with keys only, so a stolen password does not give access to our servers.

• Measures planned: enforce MFA for every account.

• Residual risk: likelihood medium, impact medium, risk medium. We expect this to fall to low once MFA is enforced for all accounts.

6. Insider misuse

• Description: a team member deliberately copies, shares or misuses client material.

• Before measures: likelihood low, impact high, risk medium.

• Measures in place: an employed, permanent editing team; confidentiality obligations in every contract; access limited to the projects someone works on; non-admin accounts; originals stay with you; deletion after delivery; access removed when someone leaves.

• Measures planned: automate deletion after delivery.

• Residual risk: likelihood low, impact medium, risk low.

7. Accidental sharing or wrong recipient

• Description: a file, link or message about your project reaches the wrong person, such as another client.

• Before measures: likelihood medium, impact medium, risk medium.

• Measures in place: client projects are kept separate; in the cloud workflow you render the final version yourself, so there is no delivery to misdirect; deliverables are made available in your own My NWW account; our incident procedure includes notifying you.

• Measures planned: none at this time.

• Residual risk: likelihood low, impact medium, risk low.

8. Connectivity or power outages on Lombok

• Description: power cuts or internet interruptions on Lombok stop editing work long enough to delay deliveries.

• Before measures: likelihood medium, impact medium, risk medium.

• Measures in place: in the cloud workflow, work syncs to the cloud as it progresses; schedules are agreed per request, not as fixed turnaround times; the time difference with Europe can leave room to catch up; editors switch to an alternative connection when the main one fails.

• Measures planned: none at this time.

• Residual risk: likelihood medium, impact low, risk low.

9. Natural hazards

• Description: earthquakes and volcanic activity occur in the region around Lombok. A major event could make workplaces unusable, cut power and connectivity for a longer period, and affect the safety of the team.

• Before measures: likelihood low, impact high, risk medium.

• Measures in place: our servers and backups are in the EU and your originals stay with you, so a local event does not destroy client data; cloud sync means work can resume where it stopped; the safety of the team comes first, and we inform you and agree new schedules.

• Measures planned: none at this time.

• Residual risk: likelihood low, impact medium, risk low. For you, the main effect would be delay, not data loss.

10. Dependency on key people and suppliers

• Description: we are a small company. Knowledge of our systems and client relationships sits with a few people, including the founder, and we depend on a small number of suppliers, such as our hosting provider and PT Starianti.

• Before measures: likelihood medium, impact high, risk high.

• Measures in place: several editors, who can take over each other’s projects thanks to cloud sync; central account management through single sign-on; encrypted backups at a separate provider; self-hosted tools on standard virtual servers, so we are not tied to one hosting provider; PT Starianti works for us as a permanent editing team; your originals and project library remain under your control.

• Measures planned: no specific measures decided yet; this risk is a focus of the next review.

• Residual risk: likelihood medium, impact medium, risk medium.

11. AI tool misuse or unintended data sharing

• Description: client material is sent to an external AI service without agreement or used to train AI models, or AI is used to create synthetic content that misrepresents people.

• Before measures: likelihood medium, impact high, risk high.

• Measures: the standard briefing estimator keeps briefs out of external AI services. Any external AI use on client material must be agreed per project and listed, with processing and transfer terms checked first. Local transcription is preferred where suitable. We prohibit using client material for AI training or generating synthetic faces, voices or statements without the required explicit written consent. A human editor reviews creative decisions. Provider compliance with these policy rules must be checked before use.

• Measures planned: list the AI services that may process client material on our sub-processors page once confirmed.

• Residual risk: likelihood low, impact medium, risk low.

12. Unlicensed content supplied by clients

• Description: material you supply, such as music, stock footage, fonts, logos or footage of people, is used without the necessary licence or permission.

• Before measures: likelihood medium, impact medium, risk medium.

• Measures in place: when agreeing the brief, we ask where music, stock footage, graphics and other assets come from and who checks permissions and licences; if we notice material that appears to be used without permission, we raise it with you before delivery; you remain responsible for the rights in the material you supply and publish under article 21 of our Terms and Conditions.

• Measures planned: none at this time.

• Residual risk: likelihood low, impact medium, risk low.

13. Non-compliant client instructions

• Description: we receive an instruction that would breach the GDPR or other law, or that would misrepresent people, such as editing a statement out of context or creating a synthetic voice without consent.

• Before measures: likelihood low, impact high, risk medium.

• Measures in place: we confirm the scope of each request in writing before work starts; we tell you if we believe an instruction infringes the GDPR, as article 28(3) of the GDPR requires; no synthetic faces, voices or statements without explicit written consent; we discuss the context needed to keep shortened statements accurate.

• Measures planned: none at this time.

• Residual risk: likelihood low, impact medium, risk low.

Transfer impact assessment summary: Indonesia

The transfer. PT Starianti’s editors on Lombok get access to client material so that they can edit it. In the cloud workflow, proxy files sync to their workstations. In the upload workflow, they work on local working copies of the footage you upload, within the 20 GB cap. In the on-site option, they view and control a machine in your building through encrypted remote desktop. Under the GDPR this still counts as a transfer, but no copy of the footage is stored outside your building. Our servers and backups remain in the EU.

Transfer tool. Indonesia has no adequacy decision from the European Commission. The transfer relies on the SCCs (Commission Implementing Decision (EU) 2021/914), Module 3, incorporated in our agreement with PT Starianti, together with this assessment under Clause 14 of the SCCs and the supplementary measures below.

The data. Mainly images and voices of people in commercial footage, such as employees, interviewees, speakers and event visitors, and names and job titles shown on screen. Much of this footage is made for publication. We do not expect special categories of personal data, such as health information, but footage from some settings, for example healthcare, can contain them. Please tell us before you share such footage.

Laws and practice in Indonesia. Indonesia has a general data protection law: Law No. 27 of 2022 on Personal Data Protection (UU PDP). Like many countries, Indonesia also gives public authorities powers to require access to electronic data, for example for criminal investigations and national security. We do not assume that these powers come with safeguards and redress equivalent to those in the EU.

Likelihood of access in practice. We consider it unlikely that Indonesian public authorities would seek access to this material. It is commercial footage that organisations make for their own communication, much of it for publication, and not the kind of data such powers usually target. Under the SCCs, PT Starianti must tell us about any legally binding request for access, review whether the request is lawful, challenge it where there are grounds to do so, and disclose no more than the minimum required.

Supplementary measures:

• Minimisation: proxies instead of originals, the on-site option, and the 20 GB cap.

• Encryption in transit: TLS, and an encrypted relay or private network for remote access.

• Deletion: working copies are deleted after delivery, and our central storage and backups stay in the EU.

• Access control: single sign-on, access per project, non-admin editor accounts, and MFA being rolled out.

• Contract and organisation: an employed team bound by confidentiality, incident notification within 24 hours, and our duty under the SCCs to suspend transfers if PT Starianti can no longer comply with them.

Conclusion. For ordinary commercial footage, we conclude that the transfer to PT Starianti can take place on the basis of the SCCs together with these measures, and we rate the remaining risk for the people in the footage as low. This conclusion depends on the SCCs being signed and in force. It is less certain for footage that contains special categories of personal data or is otherwise sensitive. For such projects we recommend the on-site option, agree extra measures with you, or advise against using our service for that project. If your own contracts or policies do not allow processing outside the European Economic Area, please tell us before you share footage: our standard service involves processing in Indonesia.

Top open actions

We plan to complete these actions and will report on progress in the next version of this document.

• Enforce MFA: make multi-factor authentication mandatory for all accounts on our single sign-on.

• Signed SCCs on file: retain the data processing and transfer agreement with PT Starianti, including the SCCs signed by both parties.

• Operate and review the manual retention procedure: record delivery and agreement-end dates, identify the files and copies concerned, assign responsibility, and record completion within the periods in our data retention policy. Do not enable automatic deletion as part of this launch.

• Document and review the transfer impact assessment: record the full assessment, including an up-to-date review of Indonesian rules on government access to data, and repeat it at least once a year.

Contact

Questions about this assessment can be sent to info@newwaywork.nl. To report a vulnerability, please follow our responsible disclosure policy.