Launch — protect before you drop

Sonifide ships. Before you drop it, protect it. Release-protection software for independent music — 0% commission, ever.

What's in the box

The first public release covers every module the prototype promised, end to end:

Core (free Demo tier)

• Workspace dashboard — real stats (active releases, ready-to-file tracks, filings YTD, pending actions). Every value is derived from your DB, never hardcoded.
• Artist Profile — encrypted at rest: IPI, address, taxpayer info.
• First-run onboarding — 4-step wizard (profile → release → track → done). Skip any step; the dashboard banner reminds you to finish.
• Metadata Manager — 9 tabs per track (Core, Artwork, Credits, Recording, Rights, Lyrics, Audio, Custom, Platforms). Full ISRC / ISWC support.
• Split Sheets — 100% sum guard, e-sign with IP + timestamp + audit, email requests via Resend.
• Release Checklist — derives state from your real data, never lies about progress.
• Registration Toolkit — real, platform-accurate file generation for BMI, ASCAP, SESAC, MLC, SoundExchange, eCO, Songtrust, ISRC. Every download includes a step-by-step instructions sheet.

Studio modules (paid tier)

• Asset Library — versioned storage, auto-resize on artwork upload (Apple 4000, Spotify 3000, Tidal 3000, Bandcamp 1400, social 1080, thumb 600).
• Credits Manager — every collaborator across every release, derived from real Split rows.
• Workbook Archive — append-only audit trail of every artifact generated for a release.
• EPK Builder — Edit / Preview / Publish modes, banner upload with overlay choices, video embeds (YouTube / Vimeo), platform-aware music + social links, public /press/{slug} route.
• Contracts — template library with {{TOKEN}} autofill from artist profile, public Sign Portal, E-SIGN Act compliant audit trail.

Label modules

• Roster — multi-artist workspace with active/released stats per artist.
• Sign Artist — modal + new artist card with deal terms.
• Grant Login — invite a roster artist to their own scoped account.
• Cross-workspace collaborations — when artist A adds artist B (with B's email) to a split, the track shows up on B's dashboard automatically.

Business modules (Label tier)

• Royalty Aggregator — import statements from BMI / MLC / SoundExchange / distributors, per-artist breakdown with deal-split math.
• Sync Pitching — supervisor CRM with email / phone / notes, pipeline value stat, status transitions.
• Press Tracker — log every placement, review, radio add, interview.
• Tax Center — auto-track 1099 thresholds ($10 royalties, $600 services), W-9 status per artist, generate provisional 1099-MISC drafts as a ZIP.

Super Admin / Control Plane

• Ops Dashboard — MRR/ARR estimates, workspace counts, audit count, recent activity feed.
• Configuration — Modules (12 seeded), Tiers (Demo/Studio/Label), Pricing (Stripe price ID reconciliation), Discounts (with Stripe coupon sync).
• Operations — Workspaces (suspend/restore), Feature Flags, Admin Users, Audit Log (filterable by source).

Infra

• 2-way Stripe — outbound coupon + product + price sync; inbound webhooks for subscription / invoice / coupon events. HMAC-verified, idempotent.
• Transactional email via Resend — artist invites, split signature requests, contract send notifications, password resets. Audit-logged per send.
• In-app notifications — bell with red unread badge, mobile sheet, fired by split_signed / contract_signed / epk_published / invoice_paid / invoice_failed.
• Google Analytics 4 — site-wide, App Router page_view on every route change.
• Sentry — error monitoring for both PHP backend and Next.js browser (no SDK install needed).
• Mobile-first — drawer nav, responsive padding, stack-on-mobile cards, horizontal-scroll tables.
• Tests — Auth (10), Split math (5), Stripe webhook (6). 21 passing, CLAUDE.md §10 satisfied.

Auth

Register / Login / Forgot / Reset / Logout all working. Password hashed with bcrypt. 2FA TOTP coming in v0.2.

Data ownership

Every workspace can export everything as a ZIP at any time. CSVs for every table + structured JSON + files. GDPR Article 20 compliant. No lock-in.

---

Founder note — this is the public alpha. Feedback to [email protected]. The roadmap from here: 2FA TOTP, real DSP delivery integration, audio analysis (BPM/key auto-detection from masters), Sync Pitching CRM enrichment, label royalty deal-split editor per artist.

Sonifide stores PII (IPI, address, tax IDs, signed contracts) encrypted at rest. A password alone shouldn't be the only thing between an attacker and that data — so 2FA is now live for every workspace.

What's new

• TOTP-based two-factor authentication — works with Authy, Google Authenticator, 1Password, Bitwarden, and every standard RFC 6238 app.
• 8 single-use recovery codes, hashed at rest, shown once on enable.
• Login flow issues a short-lived challenge token after password; the bearer token only lands after the 6-digit code verifies.
• Audit log records 2fa_enabled, 2fa_disabled, 2fa_recovery_used, and 2fa_recovery_regenerated for every account.

How to turn it on

Go to Artist profile → Security → Manage two-factor. The whole setup takes about 60 seconds: scan a QR, enter the first 6-digit code, save your recovery codes. You can disable any time with your password.

A note on recovery codes

The codes are shown once and never again. Save them in your password manager, or print them and stash them somewhere you'd find your passport. If you lose your authenticator and your codes, support has to verify your identity manually — and that takes days.