Security
How we protect your work
Facefluence is built so that one business can never see another's work, files are reached only through short-lived links, and every action is on the record.
Your workspace is yours
- Every request is scoped to your workspace; another workspace's records answer as if they don't exist.
- The database repeats the rule with row-level security.
- Team roles decide who can make, approve, pay or only look.
Private files, short-lived links
- Uploads and videos live in private storage, reached only through signed links that expire.
- Uploads are checked by their actual content, and images are re-encoded with their metadata removed.
- Our servers are in the European Union, and the database and files are hosted in an EU region.
Keys, logins and staff
- API keys are shown once, stored hashed, scoped and rotatable — with a prefix that secret scanners recognise.
- Our staff sign in with a second factor, with the least access their job needs.
- We see your workspace as you see it only with your consent, and that is always logged.
- Connection tokens, like your shop's, are encrypted with a key of our own.
Every action on the record
- An activity log records every action and API call — including AI agents acting for you, and on whose behalf.
- Agents never accept legal terms; a person does, in the app.
- Sign-up and log-in are protected against bots, and every API is rate-limited.
Marked at the source
- Every export carries signed C2PA Content Credentials and an invisible watermark.
- We never offer an unmarked export, and our terms forbid removing the marks.
Payments
- Cards are entered on our payment provider's page; we keep only a token for the charges you approve.
- Payment notifications are signed and checked, and a payment counts only if it matches the order, the amount and the currency.
What's next
Before we serve larger clients: an independent penetration test and a data processing addendum. Daily backups are on, and we rehearse a restore before launch.
Found a vulnerability?
Email support@facefluence.com with “Security” in the subject, and please give us time to fix it before telling anyone else.
support@facefluence.com