Security you can trust
How we protect your photos and data, stated plainly — including what we are not certified for.
How we protect your data
Encryption in Transit
All traffic is encrypted with TLS. We enforce HTTPS across all connections.
Encryption at Rest
Photos and data are encrypted at rest (AES-256) by our storage and database providers, Cloudflare R2 and Supabase.
Access Controls
Event access is checked on our servers and by row-level security in the database. Access to production systems is limited to the people who need it.
Host Photo Approval
Hosts can require approval before any upload appears in the gallery or slideshow, and can remove any photo at any time.
Global Infrastructure
Hosted on Vercel and Cloudflare, whose networks include DDoS protection.
Incident Response
Automated error monitoring and alerting, plus hourly automated checks of key customer journeys. Documented incident response procedures.
Compliance & Certifications
Built for GDPR
Data processing agreement available, export and deletion on request, and automatic deletion on a published schedule. We have not been independently audited.
CCPA rights supported
California residents can request access to, or deletion of, their data at any time.
SOC 2 infrastructure
Picsui runs on providers that hold SOC 2 Type II certification. Picsui itself is not SOC 2 certified.
Our security practices
- Automated weekly dependency updates
- Access to production systems limited to the people who need it
- Row-level security on the database
- Encryption in transit and at rest
- Automated database backups
- Error and anomaly monitoring
Data handling
Photo Storage
Photos are stored on Cloudflare R2, an S3-compatible object storage service with built-in encryption and global distribution.
Database
User data is stored in Supabase (PostgreSQL) with row-level security, encryption, and automatic backups.
Data Retention
Free Preview: the gallery locks after 7 days and photos are permanently deleted 30 days after upload. Event Pass, Photographer Pro and Partner events: 12 months. Deletion is automatic and enforced by the platform; you can also delete your account or an event at any time.
Data Location
Primary data storage in US regions, served globally over Cloudflare's network.
Responsible Disclosure
We appreciate the work of security researchers who help keep Picsui safe. If you discover a security vulnerability, please report it to us responsibly.
Need more information?
For security questionnaires or custom security requirements, contact us. We can point you to our providers' SOC 2 reports; Picsui itself is not SOC 2 certified.
Contact us about security