Security at ShotVista
ShotVista stores your listing photos and your clients' details. This page lists what we actually do to protect them, what we do not offer yet, and how to reach us with security questions.
Infrastructure and data location
- The application and database run on Railway (United States). Photos and delivered files are stored in Cloudflare R2. Transfers outside the EEA are covered by Standard Contractual Clauses.
- All traffic is served over HTTPS with HSTS. Data is encrypted in transit (TLS) and at rest by our storage and database providers.
- Responses carry a Content Security Policy, X-Frame-Options DENY, X-Content-Type-Options nosniff and a strict referrer policy.
Accounts and access
- Passwords are hashed with Argon2. Sessions use short-lived access tokens with separate refresh tokens. Passwordless magic-link sign-in is available.
- Login attempts are rate limited per IP, as are public forms such as contact, reviews, coupons and storefront endpoints.
- Teams have owner, admin and member roles, so studio staff only get the access they need.
- Single sign-on (SAML/OIDC) is not supported today.
Payments
- Payments for your plan and for client deliveries are processed by Stripe. Card details go directly to Stripe and are never stored on ShotVista servers.
AI processing
- Photo edits are generated through Google’s Gemini API, and upscaling runs on RunPod GPUs. Photos are sent only to process the edit you requested.
- ShotVista does not use your photos to train AI models.
Retention and deletion
- Photos and listings are kept while your account is active. You can delete individual photos, listings or your whole account from the dashboard at any time.
- For a full data export or a deletion request, email [email protected].
- Client delivery pages only show the photos you choose to deliver, and access is controlled from the delivery settings.
Compliance and questionnaires
- ShotVista is operated by Getia AS in Oslo, Norway, and processes personal data under the GDPR. A Data Processing Agreement is available to every customer.
- ShotVista does not hold SOC 2 or ISO 27001 certification.
- Security questionnaires and vulnerability reports: email [email protected] and we will respond directly.