Security and data protection.
You trust us with your clients' names, contracts, payments and photographs. Here is how we look after them, in plain English, with the legal detail in our policies.
At a glance
- HTTPS everywhere, data encrypted at rest
- Extra AES-256-GCM encryption for sensitive values
- Files in Cloudflare R2, EU jurisdiction
- UK GDPR: we're your processor, with a DPA
- Breach notice to you within 48 hours
- Passwordless sign-in: no passwords to steal
Encrypted, then encrypted again.
Every connection to Caloreel uses HTTPS. Stored data, including files and database records, is encrypted at rest by our infrastructure providers.
The most sensitive values get an extra layer of application-level encryption (AES-256-GCM) before they're stored: synced email content, connected-account tokens, lab credentials, gallery passwords and download PINs.
Card numbers never touch our systems. Payments are handled by Stripe, and we only see details such as the card brand and last four digits.
Where your data lives.
Photos, video and documents are stored in Cloudflare R2 in an EU-jurisdiction bucket. These providers help us run Caloreel, each bound by data protection terms.
| Feature | What they do | Where |
|---|---|---|
| Cloudflare | Hosting, content delivery, security, video streaming and file storage (R2) | Files stored in the EU; delivered through a global network |
| Stripe | Payments for invoices and store orders, payouts, our own billing | UK, EU and US |
| Resend | Email delivery: sign-in links, invitations, reminders, receipts | US and EU |
| Sign-in, Gmail sync, Calendar and Meet, only where you connect them | Global | |
| Prodigi | Print fulfilment, UK and worldwide | UK and international lab network |
| WHCC | Print fulfilment, US | US |
Transfers outside the UK are protected by UK adequacy regulations, the International Data Transfer Agreement or the UK Addendum. We give at least 30 days' notice before adding or replacing a sub-processor. Labs only receive what they need to fulfil an order.
Who can see what.
Your studio
Every record belongs to one studio, and access is checked against that studio on every request. Staff see only the jobs they're assigned; accountants get read-only access.
Your team
Sign-in is by single-use email links that expire after 15 minutes, or with Google. Sign-in tokens are stored hashed, and sign-in is rate-limited.
Your clients
Clients and guests never need accounts. They use signed links that expire and can be revoked, with optional gallery passwords, email allow-lists and download PINs.
Our people
Staff use multi-factor authentication for production systems. Support access to your account is time-limited and recorded in an audit log.
Backups and deletion.
- Regular backups of our databases, with restore procedures.
- Hosting on infrastructure designed for high availability.
- Code review before changes reach production, and prompt patching of known vulnerabilities.
- When you leave: a 30-day export window, then deletion from live systems, and from backups within a further 30 days.
- Caloreel is a delivery and business platform, not an archive: keep your own backups of original files too.
Found a problem? Tell us.
Email support@caloreel.com with “Security report” in the subject. We'll acknowledge it, keep you updated and tell you when it's fixed.
Please
- Include the steps to reproduce it, and what you think the impact is.
- Only test against an account you own, and never access or change other studios' data.
- Don't run denial-of-service, spam or social engineering tests.
- Give us reasonable time to fix it before you share it publicly.
We don't run a paid bug bounty yet, but we'll gladly credit you when a fix ships if you'd like us to.
Questions,
answered.
Where are my photos stored?
In Cloudflare R2, in an EU-jurisdiction bucket. They're delivered to your clients through Cloudflare's global network, and originals are never public: downloads use signed links that expire.
Do you use my photos or client data to train AI?
No. We don't use photos, client data or Google data to train artificial intelligence models, and we don't sell personal data or use it for advertising.
Do I need to sign a data processing agreement?
No separate signature is needed. Our Data Processing Agreement is part of the Terms of Service and applies automatically while Caloreel processes your clients' data for you.
What happens to my data if I cancel?
You keep access until the end of the period you've paid for, then have a 30-day window to export galleries and client records. After that we delete your data from live systems, and backup copies are deleted as those backups expire, within a further 30 days.
Will you tell me about a data breach?
Yes. Under our DPA we notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting your clients' data, so you can meet your own obligations.
Questions about your data?
We're happy to answer a security questionnaire or talk through how your clients' data is handled.