Privacy & Security

How ClearFace handles face data, and what we are still building.

  • Private Uploads never stored
  • Encrypted At rest and in transit
  • Deletable Anytime, in one click

Data Protection & Controls

The controls ClearFace is built around. We publish status as each one is verified.

Infrastructure Security

  • Unique authentication enforced
  • Encryption key access restricted
  • Production application access restricted

Infrastructure Security

  • Unique authentication enforced
  • Encryption key access restricted
  • Production application access restricted
  • Secrets managed in a dedicated store
  • Storage closed to the public internet
  • Hosted in the US

Product Security

  • Application-level encryption utilized
  • Role-based access enforced
  • Data encrypted in transit

Product Security

  • Application-level encryption utilized
  • Role-based access enforced
  • Data encrypted in transit
  • Data encrypted at rest
  • Automated checks run on every pull request

Organizational Security

  • Confidentiality agreements signed
  • Security awareness training completed
  • Access revoked upon offboarding

Internal Security Procedures

  • Continuity and disaster recovery plans established
  • Risk assessments conducted
  • Database backups configured

Internal Security Procedures

  • Continuity and disaster recovery plans established
  • Risk assessments conducted
  • Database backups configured
  • Object versioning enabled
  • Infrastructure logs retained
  • Systems monitored for errors and downtime

Data and Privacy

  • Data retention procedures established
  • Customer data deleted upon leaving
  • Data export available on request

Data and Privacy

  • Data retention procedures established
  • Customer data deleted upon leaving
  • Data export available on request
  • Data subject requests fulfilled
  • Consent recorded and versioned
  • Personal data segregated by customer

Transparency

  • Privacy policy established
  • Processing terms with every provider
  • Service providers bound by contract

Photos used to stay where you put them. Today they travel, get copied and get connected to names in ways nobody planned for.

ClearFace makes that visible.

Our Company

Frequently Asked

Is your data encrypted?

Yes. All datastores are encrypted at rest, with app-level encryption on sensitive data, and every transmission uses TLS 1.3 or higher. Access to encryption keys is restricted to the systems that need them.

Is ClearFace SOC 2 compliant?

Not yet. SOC 2 is planned, and we will report status as it changes rather than claim a certification we do not hold.

Is ClearFace available in the EU?

No. ClearFace is not offered in the EU or UK at this time.

How do you handle biometric data?

Face templates for enrolled people are stored only with their written consent, kept separate from account data, and deleted when they leave. Uploaded search photos are not kept.

Who inside ClearFace can access my data?

Access is role-based and least-privilege: unique authentication per person, restricted encryption keys, and an authorization hierarchy that grants no more than a role requires. Access is logged.

What happens to my data when I leave?

Data retention, deletion, and classification policies govern the full lifecycle. Customer data is deleted upon leaving, and secure asset disposal with maintained inventories covers the hardware side.

Do you sell my data or train AI on it?

No. We never sell your data, and nothing you search is used to train AI models.