Security

1. Our approach

The safest data is data we never receive. ShelfPics is built so that your product photos are processed on your own device, and our servers hold only what is needed to run your account and your credits. For that small amount of data we use encryption, hashing, rate limits and strict access rules.

2. Photos never leave your device

• Background removal runs in your browser with an open-source model (ISNet general-use) through Transformers.js and ONNX Runtime Web.
• Backdrops, shadows, reflections, light adjustments, resizing and export (PNG, JPG, WebP or ZIP) also run in your browser. Finished files are saved directly to your device.
• For an AI lifestyle scene, our server sends only a fixed text description of the chosen scene to Cloudflare Workers AI. Your photo is never sent, and the generated backdrop is returned to your browser without being stored.
• Because we never receive your photos, a breach of our systems could not expose them.

3. Infrastructure

The website, API and database run on Cloudflare: Cloudflare Workers for the server code, Cloudflare static asset hosting for the pages, Cloudflare D1 for the account database and Workers AI for scene backdrops. Cloudflare’s network also provides protection against denial-of-service attacks. We do not run our own servers. The model files the studio needs are downloaded by your browser from Hugging Face and the jsDelivr CDN over HTTPS. The full provider list is in our Privacy Policy.

4. Encryption

• In transit: all traffic to ShelfPics uses HTTPS (TLS). Session cookies are marked Secure so they are only sent over HTTPS.
• At rest: the D1 database, which holds account, credit, purchase and contact data, is encrypted at rest by Cloudflare.

5. Passwords and sessions

• Passwords are never stored in readable form. We store a salted PBKDF2-SHA256 hash with 100,000 iterations and a random salt for each account. Passwords must be at least 8 characters. Password checks use a constant-time comparison.
• Sessions: when you sign in we create a random 256-bit token. Your browser keeps it in the shelfpics_session cookie; our database stores only a SHA-256 hash of it, so a copy of the database would not let anyone sign in as you.
• The session cookie is HttpOnly (page scripts cannot read it), SameSite=Lax and Secure on HTTPS. Sessions expire after 30 days. Signing out deletes the session on our server.
• Rate limits: sign-in and sign-up are limited to 10 attempts per 15 minutes for each combination of IP address and email. The rate-limit records store only a hash, not your IP address in readable form.

6. Application protections

• Cross-site request forgery: requests that change data must come from our own site. Requests from other origins are refused.
• Security headers: every response sets X-Content-Type-Options: nosniff, a strict Referrer-Policy, X-Frame-Options: SAMEORIGIN (to block clickjacking) and a Permissions-Policy that turns off camera, microphone and location access.
• Server-side credit checks: credits are checked and spent in a single database operation on our server, so they cannot be changed from the browser, and each shot is charged only once.
• Payment verification: a plan is added only after our server confirms with Stripe that the payment is complete, unrefunded and belongs to your account. Each payment can be claimed once. Stripe webhooks are checked against their signature.
• Input limits and spam protection: requests are size-limited and validated, the contact form has a hidden spam trap and a rate limit, and studio requests are rate limited per account.
• Secrets such as the Stripe key are kept as Cloudflare secrets, not in our code. The Stripe key we use to confirm payments is a restricted, read-only key.

7. Payments

Payments are processed by Stripe on Stripe-hosted pages. Stripe is certified as a PCI DSS Level 1 service provider. Your card number never touches our servers and we never see or store it. We receive only the payment status and references we need to add your plan and handle refunds.

8. Who can access data

Only a small number of authorised administrators can view account, purchase and contact records, through an admin area that checks both sign-in and an approved list of admin emails. Access is used only for support, billing and security. Administrators cannot see passwords, which are hashed, or photos, which we never receive.

9. Data minimisation and deletion

• We collect only name, email, password hash, plan and credit data, purchase references, shot records (no images) and contact messages.
• An automatic daily job deletes expired sessions, shot records older than 400 days, contact messages older than 12 months and old rate-limit records.
• You can delete your account from your account page. This immediately deletes your user record, sessions, credits and shot records. Purchase records are kept for accounting and tax, with the link to you removed.

Retention periods are listed in full in our Privacy Policy.

10. Certifications

{{LEGAL ENTITY}} does not hold security certifications such as SOC 2 or ISO 27001. We rely on providers that maintain their own certifications for the infrastructure they run (for example, Stripe’s PCI DSS certification for payments), and we describe our own controls honestly on this page.

11. Incident response

If we discover a security incident, we act to contain it, investigate what happened and fix the cause. If personal data is affected, we will notify the relevant data protection authority and affected users where the law requires it, and tell you what happened, what data was involved and what you should do.

12. What you can do

• Use a strong, unique password for ShelfPics, ideally from a password manager.
• Sign out on shared computers.
• Keep your browser up to date.
• Be wary of emails asking for your password. We will never ask for it.
• Keep your own backups of finished images, since we do not store them.

13. Reporting a vulnerability

If you believe you have found a security vulnerability in ShelfPics, please email support@shelfpics.com with the subject “Security”. Include a description, the steps to reproduce it and the possible impact.

• We will acknowledge your report within 5 business days and keep you updated while we work on it.
• We will not take legal action against research done in good faith that follows these guidelines.
• Please do not access or change other users’ data, do not run denial-of-service or high-volume automated tests, do not use social engineering, and give us reasonable time to fix the issue before disclosing it.
• We do not run a paid bug bounty programme, but we are grateful for responsible reports and will credit you if you wish.

14. Sub-processors

We rely on a small number of providers: Cloudflare for hosting, the database and AI backdrop generation, Stripe for payments, and Hugging Face and the jsDelivr open-source CDN for the cut-out model and runtime files that your browser downloads. The full list, with what each provider does and where, is in the sub-processor table of our Privacy Policy.

See also our Privacy Policy, Cookie Policy and Terms of Service.