Privacy & Security

• Encrypted in transit. Every connection is served over HTTPS; insecure requests are automatically upgraded, and browsers are instructed (HSTS) to keep using encrypted connections. A valid, trusted TLS certificate is presented on every request.
• Encrypted at rest. Application data, images and records are held in a managed Postgres database and object storage that encrypt data at rest.
• Isolated per event. Each event's galleries, images and face data are scoped and access-controlled to that event — never pooled across clients.

To deliver each guest their own photos, the AI Photoshoot Studio matches a guest's selfie to their professional images using Amazon Rekognition, AWS's managed face-analysis service. We designed this privacy-first:

• Explicit consent. A guest must affirmatively consent before a selfie is used for matching. No selfie is processed without it.
• Purpose limitation. Face data is used only to match a guest to their own event photos — never for advertising, tracking, profiling, or sale.
• Per-event isolation. Each event uses its own dedicated face collection; face data is never shared or pooled across events or clients.
• Least-privilege access. A dedicated, face-matching-only cloud identity is used, and face data sits in a server-side, service-role-only tier that ordinary users and the app's browser code cannot read.
• No model training on your data. Our cloud account is configured to opt out of AI-service data use — your guests' face data is not used to improve any provider's models.
• Retention & deletion. Face data is purged when an event is archived — the face collection is deleted and the associated records removed. It is not retained beyond the life of the event.
• Regional processing. Face matching is processed in AWS US East (N. Virginia).

• Row-level security. Database row-level security is enforced on tables, so records are reachable only by the accounts explicitly authorized for them.
• Role-based admin access. Administrative access requires an authenticated account and a scoped role — an event administrator sees only their own event.
• Server-side isolation. Sensitive operations and stores (including face data) run under server-side service roles and are never exposed to the browser.
• Secret management. Keys and credentials are held in managed secret storage — never in application code or client bundles.

Enforced at the platform level and continuously verified:

• HTTPS enforcement, HSTS, and a valid TLS certificate.
• Protection against MIME-type sniffing and against clickjacking (embedding/framing restrictions).
• A Content Security Policy governing which code and content the app may load.
• A referrer policy limiting what is shared on outbound links, and a browser-permissions policy governing sensitive capabilities (camera, microphone, location).
• Secure, same-site, script-inaccessible session cookies over encrypted transport.
• The initial page avoids loading active resources over insecure connections.

• Vulnerability scanning. Deployed dependencies are checked against OSV, Google's public open-source vulnerability database.
• Software bill of materials. A machine-readable CycloneDX SBOM records the components in each published build.
• Deployment traceability. Security observations are tied to the exact published revision, content hash, and deployment time.
• Automated remediation. Automated security fixes — and, where connected, third-party assessment findings — are applied and tracked.
• Availability monitoring. Scheduled health checks monitor the published app.

We update this list as our providers change.

• Certified infrastructure. Our core infrastructure providers maintain independent audits and certifications. Amazon Web Services holds SOC 2 Type II and ISO 27001; our facial-matching data resides in AWS US East.
• Live trust center. Our application platform publishes a live, automatically-generated trust center for this app that reflects the controls it observes in real time. View it at https://aipstudio.tfp.nyc/.well-known/trust.html. That page is generated by the platform and cannot be edited by us — which is precisely what makes it worth trusting.
• SOC 2 — in progress. Turner Family Portraits is actively pursuing SOC 2 for the AI Photoshoot Studio. This page reflects the controls in place today; it is informational and does not itself constitute a certification, and we will not represent it as one until an audit is complete.

If you believe you've found a security or privacy issue, please contact security@tfp.nyc. We investigate promptly; deployed dependencies are continuously screened and fixes are tracked to the exact revision they ship in.

• Consent. Facial matching happens only with a guest's explicit consent.
• Access & deletion. Guests and clients may request access to, or deletion of, their data — including their event's face data — by contacting us; face data is in any case purged when the event is archived.
• No sale, no ad use. We never sell personal data and never use guest images or face data for advertising.

Questions? Contact privacy@tfp.nyc