This Policy explains the technical and organisational measures PixoProof applies to protect the platform, user accounts and data, and how long different categories of data are retained. It forms part of PixoProof’s information security and privacy framework and should be read together with the Privacy Policy, Terms of Service and Data Processing Addendum.
PixoProof is operated by a small team. We describe here what we actually do, rather than a generic programme.
01Security principles
PixoProof is committed to protecting the confidentiality, integrity and availability of the Services and the data processed through them. Measures are chosen on a risk basis and reviewed as the platform changes.
02Technical security measures
- Encryption of data in transit using modern TLS; Cloudflare sits in front of every host and the origin firewall accepts web traffic only from Cloudflare.
- Encryption at rest for photo storage and generated previews (Cloudflare R2) and for database backups, which are encrypted before upload.
- Gallery PINs stored encrypted; passwords stored as salted hashes; sign-in sessions use short-lived tokens with refresh.
- Rate limiting on sign-in, gallery PIN entry and media access to resist brute force; client access scoped per invite.
- Least-privilege, key-based administrative access limited to the PixoProof team; no password-based server access.
- Audit logging of account and gallery actions, application monitoring and alerting (Grafana Cloud) and error tracking with secrets scrubbed (Sentry).
- Signed, time-limited URLs for media delivery with access checks on every request.
- Secure software development with automated tests, dependency and vulnerability advisories monitored, and security updates applied in regular releases.
- Nightly and pre-deployment database backups with a rehearsed restore procedure.
03Organisational measures
- Confidentiality obligations for everyone with access to systems or data.
- Production access reviewed whenever team membership or roles change.
- A documented incident response and breach notification procedure (see below).
- Review of each sub-processor’s security and data protection terms before use; the current list is on the Sub-processors page.
04Password and account security
Users are responsible for choosing strong, unique passwords, keeping credentials confidential, keeping their devices secure, and promptly notifying PixoProof of any suspected unauthorised access. PixoProof enforces minimum password requirements and may require a password reset if compromise is suspected. Multi-factor authentication for user accounts is not yet available; we will announce it when it ships.
05Vulnerability management and responsible disclosure
We monitor security advisories for the frameworks and libraries we use, prioritise fixes by risk, and test significant changes before release.
We welcome good-faith reports of potential security vulnerabilities at [email protected]. We aim to acknowledge valid reports within two business days and will not pursue legal action against researchers who act in good faith, follow responsible disclosure practice, and do not access, modify or delete user data or disrupt the Services.
06Incident response
If a security incident affects the confidentiality, integrity or availability of the Services or personal data, PixoProof will investigate and contain it, assess impact and scope, remediate the root cause, notify affected users and relevant authorities as required by law and contract, and document the incident and lessons learned.
Photographers whose client data is affected are notified within 48 hours under the Data Processing Addendum. Where the GDPR or UK GDPR applies, the supervisory authority is notified within 72 hours; under the Australian Notifiable Data Breaches scheme, as soon as practicable.
07Data retention
PixoProof retains data only for as long as necessary to provide the Services, comply with legal obligations, resolve disputes and enforce agreements. Current retention periods:
| Data | Retention |
|---|---|
| Account data (profile, settings, subscription status) | Life of the account; deleted within 30 days of account closure. Free plan accounts are deleted after 30 days without a sign-in. |
| Gallery content and photos | Until deleted by the Photographer, until gallery expiry when the Photographer chose “delete after expiry”, or on account closure. Deletion is permanent. |
| Client details and gallery access records | With the gallery they belong to |
| Audit and security logs | 24 months |
| Gallery analytics events | 12 months |
| Download logs (IP address, browser or app) | 12 months |
| Transactional email records | 6 months |
| Read in-app notifications | 90 days |
| Encrypted database backups | 30 days |
| Payment and invoice records | As required by tax and accounting law (held by Stripe and in our billing records) |
| Support and contact-form messages | 24 months |
Photo files are not included in backups. Photographers should keep their own copies of original files.
08Free plan inactivity
Free plan accounts with no successful sign-in for 20 consecutive days receive an email warning, and a final warning at 25 days. At 30 days without a sign-in the account is suspended and permanently deleted, including galleries, files, client information, metadata and account data. Deleted data cannot be recovered.
09User responsibilities
- maintain the security of your own devices and networks;
- use strong authentication practices;
- do not probe, scan or test the vulnerability of the Services without prior written authorisation, other than good-faith research under the disclosure terms above;
- report suspected security incidents promptly.
10Changes to this Policy
PixoProof may update this Policy to reflect changes in technology, risk or legal requirements. The version number and “Last updated” date at the top show when the most recent changes were made.
11Contact
PixoProof · Email: [email protected] · Website: pixoproof.com
Version history: 1.0 (14 September 2026) first release. 1.1 (8 October 2026) replaced generic claims (user MFA, staff training, background screening, network segmentation, vendor assessments) with the measures actually in place, stated that photo files are not backed up, and added the real retention table and the Free plan inactivity schedule. 1.2 (9 October 2026) shortened the Free plan inactivity schedule to warnings at 20 and 25 days and suspension with permanent deletion at 30 days.