Skin data is sensitive. We treat it that way.
Encryption, access controls, and compliance aren't an afterthought — they're built into the same pipeline that powers every scan.
Security built into every layer
Data Encryption
All scan data is encrypted with AES-256 at rest and TLS 1.3 in transit, end to end.
GDPR
Full data subject rights — access, export, and deletion — available directly from account settings.
HIPAA-Ready
Business Associate Agreements and HIPAA-aligned infrastructure available for clinical deployments.
SOC 2 Roadmap
SOC 2 Type II audit is in progress, with controls already mapped to the Trust Services Criteria.
Privacy
Scans are never sold and never used to train shared models without explicit, revocable opt-in.
AI Safety
Every model is evaluated for bias across skin tones, ages, and genders before release.
Cloud Security
Network isolation, least-privilege IAM, and continuous vulnerability scanning across all environments.
AWS Infrastructure
Built on AWS with encrypted S3 storage, VPC isolation, and automated failover across regions.
Where we are, and what's next
GDPR & data subject rights
Full access, export, and deletion controls available to every user, in every region.
AES-256 & TLS 1.3
Encryption at rest and in transit across all scan data and derived AI outputs.
SOC 2 Type II audit
Controls mapped and evidence collection underway with an independent auditor.
HIPAA BAA general availability
Expanding HIPAA-aligned infrastructure from pilot clinics to general Enterprise availability.
Need a security review for procurement?
We provide security whitepapers, DPAs, and BAAs for Business and Enterprise customers.