Security

Your photos are your business. Here is exactly how we look after them, and what we have not built yet.

Where your files live

Working files and delivered galleries are stored with Supabase in Sydney, Australia (AWS ap-southeast-2).

Camera originals (RAW files) are stored with Backblaze B2 in the United States (US West).

Every delivered photo also gets a second copy with Backblaze B2, also in the United States. Each copy is read back and its SHA-256 hash compared with the original before we count it.

Encryption

• • All traffic to and from SLEEEK uses TLS
• • Our sites send HSTS with a two-year lifetime, so a browser that has visited once will not fall back to an unencrypted connection
• • Database connections require SSL
• • Files held with Supabase are encrypted at rest (AES-256)

Who can see a file

Client photo storage is private. Nothing is served without a time-limited signed link or a gallery link. Signed links last 5 minutes by default. Links inside a page a client keeps open, such as a gallery or a floor plan, last up to 24 hours.

• • A gallery link can carry a password and an expiry, set by the studio
• • Full-resolution photo downloads by clients and by editors are logged: who, when, and which photos. If that log entry cannot be written, the download is refused rather than let through unrecorded. Delivered video downloads are logged too, but a failed log entry does not block them, and staged-image downloads are not logged yet
• • Every studio's files are separated by database row-level security, and an upload can only land in the studio's own storage area

Recovery

• • A shoot cannot be hard-deleted
• • Studio files have a 30-day bin
• • Backblaze keeps a deleted or overwritten file version for 30 days before removing it
• • Delivered photos keep a version history. Any version can be restored, and a restore never overwrites; it adds a new version
• • The database is backed up daily, with 7 days kept

Accounts

• • Account passwords must be at least 8 characters, and are checked against lists of known breached passwords
• • Portal sessions use httpOnly, secure, same-site cookies
• • When a studio removes a team member, we try to end that person's sessions on every device as part of the removal. If that step fails, the removal still completes and the failure is recorded

Activity record

Admin actions and client downloads are recorded in an audit log. The log is append-only. The application cannot delete an entry or rewrite what it recorded. An entry that is waiting on an outcome can have that outcome added once. When a person or a studio is deleted, the link from their entries to that account is cleared, and the entries themselves stay. Maintenance by our own operators needs a deliberate, separate step.

Our providers' certifications

These are certifications our providers hold, not SLEEEK. We rely on them; we do not claim them.

• • Supabase holds SOC 2 Type 2 (supabase.com/security)
• • Backblaze holds SOC 2 Type 2 (backblaze.com/cloud-storage/security)
• • Vercel holds SOC 2 Type 2 and ISO 27001 (vercel.com/security)
• • Amazon Web Services, which Supabase runs on, holds ISO 27001 and SOC certifications (aws.amazon.com/compliance)

SLEEEK itself does not hold a security certification yet. We would rather tell you that than imply otherwise.

What we have not built yet

• • Two-step verification for studio logins (in progress)
• • A self-serve export of everything a studio holds (available on request today)

Report a problem

If you find a security issue, or think something has gone wrong, contact us at [email protected].

If something goes wrong, we tell affected customers, and the Office of the Privacy Commissioner, as soon as practicable about any breach likely to cause serious harm, as the Privacy Act 2020 requires.