Security and privacy
A content platform often holds the most sensitive material an organisation has: customers’ faces, contracts with photographers, embargoed work. Here is what we do with it, and what we deliberately do not do.
Safeguards
Two locks on tenant isolation
Every action passes one authorisation layer that decides per workspace, per collection and per asset. On top of that, row-level security is enabled in the database, forced even for the role the application connects with. If a query ever slips past the first layer, it returns zero rows rather than someone else’s files.
Biometrics are off
Face detection — someone is present — is always available. Face recognition — who it is — is off by default and can only be enabled by the owner, with a recorded legal basis and responsible party, logged in the audit trail. Consent is per person and revocable; withdrawal genuinely deletes the face vectors.
Your bucket, your region
On Enterprise you connect your own S3, Azure Blob or GCS. The data region is configurable per organisation, EU or US. Downloads run through short-lived presigned URLs, never through a public bucket.
Rights that stop publication
An expired licence, an active embargo or a missing model release blocks publication — for staff and for anyone with a share link. The system always says why, so people fix it instead of working around it.
An audit log that cannot be edited
Who did what and when is fixed. The table accepts inserts only; updates and deletes are refused at database level. By us as well.
What we do not have yet
No SOC 2 report and no ISO 27001 certification. Both are planned, but we will not put a badge on the site before it is true. Ask us where we stand — you will get a straight answer.
Questions
Questions we often get
- Does our imagery go to an AI service outside the EU?
- Provider choice and data region are configurable per organisation. If you want everything to stay inside the EU, we run on EU providers — that is a setting, not a migration.
- What happens when someone withdraws consent?
- That person’s face vectors are deleted, not flagged, and the linked assets are shielded. A checkbox that shields nothing is worse than no checkbox.
- Can we take our data with us if we leave?
- Yes. Originals sit untouched in object storage — on Enterprise in your own bucket — and metadata is exportable. A platform you cannot leave is a platform you should not enter.