Where it lives, who can open it, and what happens when somebody leaves.

The short version

Six facts, and two of them are qualified.

• Media and database both sit with Supabase, in the United States.
• Everything travels over an encrypted connection and is stored encrypted.
• Access rules are enforced in the database itself, not only in the app, so they hold no matter how the data is queried. The one path outside that check is a signed media link already handed out: it is a bearer token until it expires, and the expiry is the bound rather than the membership check. Those windows are short and are stated below.
• One workspace can never see another workspace’s media.
• Removing somebody’s membership ends their access immediately. One bound worth knowing: a media link their app had already opened keeps working until it expires, which is five minutes for a photo and up to four hours for a video.
• We do not run advertising, we do not track you across other apps, and we do not sell anything to anybody. We do use product analytics and crash reporting, both named below.

Who can see what

The rules the database enforces

These are not conventions the team is asked to follow. They are conditions on the query.

• A photo in an album is visible to everyone in that workspace. Albums exist to share.
• A photo not in an album is visible only to the person who uploaded it, and to the workspace owner and admins.
• Editing and approving is limited to your own media, and to managers and above.
• Nobody outside your workspace can see any of it.

Sign in

Two ways in, both tied to an email you control

The dashboard takes either a password or a one-time code sent to your email, and supports a password reset. The iOS app signs in with a one-time code. The session is held in the iOS keychain on the device.

Subprocessors

A deliberately short list

These companies process data so the product can function, and for no purpose of their own. All but one are under contract with us. The exception is OpenStreetMap, whose Nominatim service is a free public one we use under its usage policy rather than an agreement, which is worth knowing if your review distinguishes the two.

• Supabase — the database and the media files, in the United States.
• Resend — delivers sign-in codes and password resets by email. It also carries the access-request form from this site — name, email, company and a description of the events you run — and membership invitations, which contain the invited address, the inviting organisation’s name and an install link.
• Apple — distributes the app through TestFlight and the App Store.
• PostHog — product analytics in the iOS app: which screens are opened, whether captures and uploads succeed, and a few product actions such as creating an album or assigning media to one, with the number of items assigned. Session replay is switched off.
• Sentry — crash and error reporting from the iOS app. Automatic collection of personal information is switched off and request URLs are stripped from its trail, because a signed URL is a credential. It is sent your account identifier so a crash can be tied to the session that produced it. PostHog is sent the same identifier.
• Expo — serves over-the-air code updates. The app checksu.expo.dev at every launch in production and preview builds and downloads an update when one is published. The check carries device and build information, never media or account data. Worth stating for a security review rather than burying: an over-the-air update changes the JavaScript running on the device without going through App Store review, so Expo is in the trust path for what the app does, not only for how it is delivered.
• OpenStreetMap — turns coordinates into a place name through its Nominatim service, under that service’s usage policy. It receives the location, from the file or from the app’s own reading when somebody shoots inside Team Capture, and never the photo.

Not yet

What is not built yet

A security page that only lists strengths is an advertisement. These are the gaps as of today.

• Single sign-on is not built yet. It is listed on the Business plan because it is on the roadmap, not because it is available today.
• Deleting media marks it deleted and takes it out of the product, but does not yet erase the stored file. Write to us and we will erase it.
• People can delete their own uploads. There is no administrator control for deleting somebody else’s media, in the app or the dashboard. Removing anything else means writing to us, which is not good enough for a workspace at scale and is on the list to fix.
• When a workspace is closed, its records are removed. The stored files are erased on request rather than automatically.
• We have no third-party security certification. If your procurement process requires one, tell us early rather than late.