Security & Compliance

How we protect your data and your unreleased imagery.

ShotSync turns raw fashion shoots into channel-ready product listings. Here are the security controls we operate today and the compliance work on our roadmap.

Live — in place today On roadmap — planned, not yet in place

Your imagery stays on your device

Pre-launch shoots are clustered, renamed and formatted in your browser — not uploaded to our servers as part of the workflow.

Every brand is isolated

Database-level Row-Level Security enforces strict tenant separation — one organisation can never read another’s data.

Built on audited infrastructure

Every layer runs on SOC 2 Type II–certified providers — Supabase, Vercel and Stripe — so we inherit their controls.

We never touch card data

Payments run entirely through Stripe (PCI-DSS Level 1). ShotSync never sees, transmits or stores card details.

Security controls

Tenant data isolation

Postgres Row-Level Security scopes every query to the caller’s organisation across all tables.

Live

Encryption in transit

TLS on every request; HTTP is redirected to HTTPS and HSTS is enforced site-wide.

Live

Encryption at rest

Database and file storage encrypted at rest, managed by Supabase and Vercel.

Live

Client-side image processing

Clustering, renaming, resizing and formatting run in the browser; only the final listings you choose to publish leave your device.

Live

Payment security

Stripe (PCI-DSS Level 1) handles all billing; webhooks are cryptographically signature-verified.

Live

Authentication & MFA

Managed authentication via Supabase, with multi-factor authentication available to accounts.

Live

Hardened HTTP headers

HSTS, MIME-sniffing protection, and referrer & permissions policies applied across the site.

Live

Managed backups & monitoring

Automated database backups via Supabase; application error monitoring with sensitive-data scrubbing.

Live

SOC 2 Type II report

Independent audit of our own controls, pursued on top of our already-audited stack.

On roadmap

Third-party penetration test

Annual external assessment, with a summary letter available under NDA.

On roadmap

Single Sign-On (SAML)

SSO and directory-based provisioning for enterprise plans.

On roadmap

Rate limiting & WAF

Expanded abuse protection and a managed web-application firewall at the edge.

On roadmap

How we handle your data

Your unreleased imagery never leaves your device by default.

ShotSync was built for brands working with product imagery that hasn't launched yet. The workflow — grouping images into products, labelling angles, renaming, resizing and formatting for each destination — runs entirely in your browser.

The only images that leave your device are the final, formatted listings you explicitly choose to publish to a platform you've connected. Raw and pre-launch shoots are never uploaded to ShotSync's servers as part of processing.

Sub-processors

Provider	Purpose	Data handled	Compliance
Supabase	Database, authentication & file storage	Account & product data	SOC 2 Type II
Vercel	Application hosting, CDN & edge	Requests & operational logs	SOC 2 Type II
Stripe	Payment processing	Billing details (no card data stored by ShotSync)	PCI-DSS L1 · SOC 2
OpenAI	AI product copy generation	Product attributes & prompts	SOC 2 Type II
Sentry	Error monitoring	Diagnostic data (PII-scrubbed)	SOC 2 Type II

Our current sub-processor list. A signed Data Processing Agreement (DPA) is available on request — email hello@shotsync.ai.