Security Overview

Traffic between your browser and the Service runs over TLS. Photos, generated results, and database contents are encrypted at rest by the infrastructure providers that hold them (Google Cloud Storage, Cloudflare).

Photos are never served from a public bucket. Every read goes through a signed, expiring URL issued by the API after it has checked that the account may see that file.

Every request to the API is authenticated, and authorisation is checked per project and per organization, not merely at sign-in. A member of one clinic cannot read another clinic’s material.

Access to production systems is limited to the people who operate them, and administrative actions taken on an organization’s data are recorded in that organization’s audit log.

Privileged actions in an organization — access, disclosure, and administrative change — are written to an append-only, per-organization ledger that is never updated or deleted.

Each entry is chained to the one before it, so a missing or altered entry can be detected. An organization owner can verify the chain and export the log as CSV.

Each organization is a separate billing and data subject. Projects, credits, references, and audit records belong to one organization and are queried under that organization’s identity.

Leaving an organization removes a member’s access to its material; the material itself stays with the organization.

A share link expires automatically, after 7 days by default and 30 days at most, and can be revoked before then.

Shared pages are marked noindex, and a link can be protected with a passcode. Repeated failed unlock attempts are counted and the link can be closed.

Deleted projects are purged within 30 days and draft uploads within 7 days. A deleted account is fully removed after a 30-day grace period.

Deletion removes the photo and everything derived from it, including facial measurements. Electronic files are deleted by means that prevent recovery.

If we learn that personal information has been exposed, we tell the affected users without undue delay what was exposed, when and how, what we are doing about it, and what they can do, and we notify the supervisory authority where the law requires it.

If you believe data has been exposed, or you have found a vulnerability, write to us at the address below. Please give us the detail needed to reproduce it, and time to fix it before disclosing it publicly.