Security & data protection
Your face is personal. Photos of you deserve extra care — here is exactly how we keep your data secure and under your control.
Encrypted in transit and at rest
All data is encrypted in transit and at rest, and employee access to personal data is limited.
EU hosting, GDPR-compliant
Your data is hosted on secure European servers and processed in accordance with the GDPR. Photos are processed by Google Gemini to generate your headshots. Transfers to subprocessors outside the EEA rely on Standard Contractual Clauses.
Uploads auto-deleted in 30 days
The selfies you upload are automatically deleted within 30 days. You can request deletion of your data at any time, and deleting your account erases everything, including any files still in storage.
Payments handled by Stripe
All payments are processed securely via Stripe. We never see or store your card details.
We never sell your data
We never sell your personal data to third parties. Subprocessors only process data on our behalf under GDPR-compliant agreements.
Your data-subject rights
Access, rectify, erase, export, restrict, or object to processing of your data. Contact legal@faceshot.ai and we respond within 30 days.
The authoritative details
This page summarizes our commitments. For the full, binding terms, read the documents below.
For security and procurement reviews
- Do you support SSO (SAML or OIDC)?
- No. FaceShot does not offer SAML or OIDC single sign-on. People sign in with email and password, a one-time email link, or Google or Apple sign-in.
- Do you hold SOC 2 or ISO 27001 certification?
- No. FaceShot does not hold SOC 2, ISO 27001 or any other security certification. The commitments on this page come from our Privacy Policy, Data Processing Agreement and subprocessor list.
- Can you sign a Data Processing Agreement?
- Yes. Our Data Processing Agreement is published and applies to customers who process personal data with FaceShot, for example a company creating headshots for its team.
- How do I send a security questionnaire?
- Email it to legal@faceshot.ai with your company name and deadline. We answer from the documents linked on this page and tell you plainly when something is not in place.
Questions about your data?
Our data protection team is here to help with access, erasure, or any privacy request. Email us at legal@faceshot.ai.