What follows describes how the product is built, not what we intend to build. Where something is not implemented yet, it says so.
A selfie is received in memory, converted to a numeric face descriptor, compared against that one event, and discarded when the request ends. It is never written to disk, to a database or to a log, and it is never sent to a third-party face API.
Photos you upload are indexed into numeric descriptors stored against that event. They are not readable by any browser client, and they are removed with the event.
Every record carries its owning workspace, and access is enforced by row-level security in the database rather than by application code alone. Face search is scoped to a single event in the query itself.
Originals stay in private storage. Only the derivatives intended for your event page are public, and those are re-encoded without camera metadata.
Uploads use short-lived permissions scoped to one object. The browser never receives a storage credential it could reuse.
We do not hold a SOC 2 or ISO 27001 certification, and we do not claim one. Independent penetration testing and a published incident-response commitment are planned before general availability.
