Start now

Security Policy

HeadshotPro's security policy outlines the organizational and technical safeguards implemented to protect customer data.

Security PolicyEFFECTIVE DATE: March 12, 2025

Overview

At HeadshotPro, protecting customer data is our top priority. This Security Policy outlines the organizational and technical safeguards implemented to prevent unauthorized access, use, alteration, or disclosure of customer data. HeadshotPro utilizes Google Cloud Storage (GCS), Render, and Vercel platforms. We encourage reviewing our Terms of Service and Privacy Policy for additional details.

Security Team

Our security team includes experienced professionals who have successfully designed, built, and operated secure, internet-facing systems across startups and large corporations.

Security Best Practices

Incident Response

  • Established formal procedures for security events with comprehensive training for all staff.
  • Immediate escalation, team assembly, and response to security incidents.
  • Detailed post-mortem analyses following each incident, reviewed internally and distributed to all relevant teams.
  • Prompt written notification to affected customers upon verifying any security breach, detailing the breach and status of our investigation.

Build Automation

  • Fully automated deployment processes enabling secure and reliable updates within minutes.
  • Multiple daily deployments facilitate rapid deployment of critical security patches.

Authentication

  • Mandatory two-factor authentication (2FA) and strong password policies enforced across GitHub, Render, GCS, and Vercel.

Infrastructure Security

  • Entirely cloud-based operations; HeadshotPro does not operate physical servers or infrastructure hardware.
  • Customer data and services hosted and protected by GCS, Render, and Vercel security practices.
  • Robust disaster recovery strategies, including comprehensive backups for all customer data.

Application Monitoring

  • Active monitoring using Sentry to rapidly identify and resolve issues.
  • Logging of all access to HeadshotPro applications and production consoles.

Data Management

  • Customer photos and generated headshots are stored at rest in the European Economic Area by default (Cloudflare R2, Western Europe).
  • Failover storage is replicated in encrypted form to the United States (Google Cloud Storage, us-east-1) for backup and disaster recovery only. Application servers run in the United States (Render, hosted on AWS).
  • Customer data stored securely in multi-tenant environments, with strict logical separation enforced by application-level privacy controls.
  • Systems handling customer data are securely configured following industry-standard security and system-hardening practices.
  • Use of subprocessors (Cloudflare, GCS, Render, Vercel) to assist in securely managing customer data.

AI Model Training

  • Uploaded photos and generated headshots are never used to train, fine-tune, or otherwise improve any AI model, ours or any third party's. This is an absolute commitment with no exception.

Data Transfer

  • 100% HTTPS service delivery.
  • Encryption of all data transmissions using industry-standard TLS/SSL protocols with 256-bit encryption.
  • Sensitive data encrypted using AES-256 encryption standards.

Payment Processing

  • All transactions processed securely through Stripe.

Customer Responsibilities

  • Secure management of user accounts and organizational data.
  • Protection of user credentials and access via secure email practices.
  • Compliance with the HeadshotPro Terms of Service and applicable laws.
  • Immediate notification to HeadshotPro regarding compromised credentials or suspected security incidents.
  • Security penetration testing or assessments require explicit advance written authorization from HeadshotPro.