How PixelDepot is built to hold your images.

What is running today

The public Face Analyze API and geometry-only Face Detect beta are serving authenticated API keys. Accounts, organization isolation, request history and the beta playground are active.

• The beta list lives in Supabase Postgres in AWS us-east-1, with Row Level Security enabled and no policies, so the publishable key that ships to every browser can neither read nor write it. A server action holding the secret key does the insert.
• Rate limiting counts submissions in the database rather than in the web process, because serverless instances do not share memory. It stores a one-way HMAC of the caller address, never the address.
• PixelDepot sets no cookies of its own and carries no advertising or third-party tracking scripts.
• The framework header is disabled, unhandled errors return a stable code with no stack trace or filesystem path, and logs are structured JSON carrying a request ID and no payload.

Runtime images: retention by service

The payload rule is selected by endpoint and enforced below the route handler:

• Face Analyze images and results are retained in organization-private storage for up to 7 days, then deleted automatically.
• Retention health monitors the oldest surviving Analyze payload and overdue counts so a stalled deletion job cannot look like success.
• Face Detect images and response geometry are never retained. Its request-history row contains operational metadata and is marked unavailable immediately using database time.
• Database guards reject a Detect result body and reject any stored asset attached to a no-retention request.
• Pixels, transient facial representations and response geometry never enter logs, analytics, crash dumps or backups.
• No customer image is used for training without a separate, explicit written agreement.

Biometric restraint by design

Face Analyze and Face Detect create no enrollment record and store no face embedding. Transient facial representations are computed in memory and never persist between requests.

Customers contractually undertake not to use apparent_ancestry for EU processing. The field is not withheld per caller and we do not infer jurisdiction from IP geography. Face recognition and 1:N matching are not offered, and sit behind a separate biometric-privacy and licensing review.

Keys and tenant isolation

These controls are active for the public endpoints and request history:

• API keys stored as HMAC-SHA256 with a server-side pepper, the full secret shown exactly once, and revocation supported.
• Separate live and test keys.
• Row Level Security on every table in an exposed schema, tested per role and for cross-tenant denial.
• Rate limiting by API key, organization and IP risk signal.
• Audit logs for administrative changes and API-key operations.

Handling the images we are sent

Also a commitment for launch, and a list of how image endpoints get attacked:

• Input size, dimension, format and timeout limits.
• SSRF and DNS-rebinding protection on remote-image fetching: private, loopback, link-local and metadata-service addresses blocked, redirects validated, download size and time capped.
• File-signature validation rather than trusting a MIME type or a file extension.
• EXIF stripped on ingest unless explicitly requested and justified.

Reproducibility

Every response names the model versions and SHA-256 weight digests behind it, so you can pin a version and diff a regression. Nothing ships until a human has signed off on all four licenses: code, weights, training data and dependencies.

Your responsibilities

Notice and consent from the people in your images, before capture, in the form your jurisdiction requires. Keeping your API keys secret and rotating them when someone leaves. Controlling who in your organization can call the service, and securing the systems you store our responses in.

Vendors

Vercel serves the site. Supabase holds the beta list and, later, account data. Resend sends the confirmation email. Paddle will process payments as merchant of record, with card details entered in Paddle-hosted flows. We do not receive or store card numbers.

Reporting a vulnerability

Write to security@pixeldepot.ai with enough detail to reproduce it. We will confirm receipt, tell you what we find, and credit you if you want the credit. Please give us a reasonable chance to fix it before publishing, and please do not run tests that degrade the service or touch anyone else's data.

What we do not claim

No SOC 2 report, no ISO certification, no third-party penetration test, and no counsel-reviewed data processing agreement. Those arrive with the product, and this page will say so on the day they do and not before.