Security & Compliance

How we protect your data and your unreleased imagery.

ShotSync turns raw fashion shoots into channel-ready product listings. Here are the security controls and data-handling practices we operate today.

Your imagery stays on your device

Pre-launch shoots are clustered, renamed and formatted in your browser — not uploaded to our servers as part of the workflow.

Every brand is isolated

Every query is scoped to the caller’s organisation, enforced in the application layer and backed by an automated check that runs on every code change.

Built on audited infrastructure

Every layer runs on SOC 2 Type II–certified providers — Supabase, Vercel and Stripe — so we inherit their controls.

We never touch card data

Payments run entirely through Stripe (PCI-DSS Level 1). ShotSync never sees, transmits or stores card details.

How we handle your data

Your unreleased imagery never leaves your device by default.

ShotSync was built for brands working with product imagery that hasn't launched yet. The workflow — grouping images into products, labelling angles, renaming, resizing and formatting for each destination — runs entirely in your browser.

The only images that leave your device are the final, formatted listings you explicitly choose to publish to a platform you've connected. Raw and pre-launch shoots are never uploaded to ShotSync's servers as part of processing.

Security controls

Tenant data isolation

Every database query is scoped to the caller’s organisation through a single shared access layer. An automated guard runs on every code change and blocks any new query that skips it.

Live

Encryption in transit

TLS on every request; HTTP is redirected to HTTPS and HSTS is enforced site-wide.

Live

Encryption at rest

Database and file storage encrypted at rest, managed by Supabase and Vercel.

Live

Client-side image processing

Clustering, renaming, resizing and formatting run in the browser; only the final listings you choose to publish leave your device.

Live

Payment security

Stripe (PCI-DSS Level 1) handles all billing; webhooks are cryptographically signature-verified.

Live

Authentication & MFA

Managed authentication via Supabase, with multi-factor authentication available to accounts.

Live

Hardened HTTP headers

An enforcing Content Security Policy, HSTS with preload, clickjacking protection, MIME-sniffing protection, and referrer & permissions policies applied across the site.

Live

Managed backups & monitoring

Automated database backups via Supabase; application error monitoring with sensitive-data scrubbing.

Live

Sub-processors

Provider	Purpose	Data handled	Compliance
Supabase	Database, authentication & file storage	Account & product data	SOC 2 Type II
Vercel	Application hosting, CDN & edge	Requests & operational logs	SOC 2 Type II
Stripe	Payment processing	Billing details (no card data stored by ShotSync)	PCI-DSS L1 · SOC 2
Anthropic	AI product copy generation	Product attributes & prompts	SOC 2 Type II
OpenAI	Accessory category detection from images	Low-resolution product image crops	SOC 2 Type II
Replicate	Background removal (when enabled at export)	Product images you select	SOC 2 Type II
PhotoRoom	Background removal at higher volumes	Product images you select	GDPR compliant
Resend	Transactional email	Name & email address	SOC 2 Type II
Cloudflare	Bot protection on sign-in and sign-up	IP address & browser signals	SOC 2 Type II · ISO 27001
Sentry	Error monitoring	Diagnostic data (PII-scrubbed)	SOC 2 Type II

Our current sub-processor list. A signed Data Processing Agreement (DPA) is available on request — email hello@shotsync.ai.