Security you can trust
Your photos and data are protected by enterprise-grade security. We take security seriously so you don't have to worry.
How we protect your data
Encryption in Transit
All data is encrypted using TLS 1.3 during transmission. We enforce HTTPS across all connections.
Encryption at Rest
Photos and data are encrypted at rest using AES-256 encryption on enterprise-grade cloud infrastructure.
Access Controls
Role-based access control (RBAC) ensures users only access what they need. Event-level permissions for galleries.
AI Content Moderation
Automatic detection and filtering of inappropriate content before it appears in galleries.
Global Infrastructure
Hosted on Cloudflare and Vercel edge networks with automatic failover and DDoS protection.
Incident Response
24/7 monitoring with automated alerting. Documented incident response procedures.
Compliance & Certifications
Built for GDPR
Data processing agreement available, export and deletion on request, and per-plan retention you can shorten. We have not been independently audited.
CCPA rights supported
California residents can request access to, or deletion of, their data at any time.
SOC 2 infrastructure
Picsui runs on providers that hold SOC 2 Type II certification. Picsui itself is not SOC 2 certified.
Our security practices
- Automated dependency vulnerability scanning
- Multi-factor authentication on administrative access
- Principle of least privilege access
- Row-level security on the database
- Encryption in transit and at rest
- Automated database backups
- Error and anomaly monitoring
Data handling
Photo Storage
Photos are stored on Cloudflare R2, an S3-compatible object storage service with built-in encryption and global distribution.
Database
User data is stored in Supabase (PostgreSQL) with row-level security, encryption, and automatic backups.
Data Retention
Free Preview: the gallery locks after 7 days and photos are permanently deleted 30 days after upload. Event Pass and Picsui Complete: 12 months from upload. Deletion is automatic and enforced by the platform; you can also delete your account or an event at any time.
Data Location
Primary data storage in US regions, served globally over Cloudflare's network.
Responsible Disclosure
We appreciate the work of security researchers who help keep Picsui safe. If you discover a security vulnerability, please report it to us responsibly.
Need more information?
For security questionnaires or custom security requirements, contact our security team. We can share our providers' SOC 2 reports; Picsui itself is not SOC 2 certified.
Contact security team