Our security principles
Three ideas guide every technical decision we make:
- Collect less. We store templates, not images. We store hashes, not passwords. We store what we need, and nothing more.
- Assume compromise. Every layer is designed so that a breach of one layer does not expose the others. Hashes are HMAC-signed with a server secret. Templates are useless on their own.
- Fail closed. When something goes wrong — a database outage, a config error — the system denies access rather than allowing it. Availability is important; integrity is non-negotiable.
Biometric data protection
Your face never leaves your device as an image. Here's exactly what happens when you enroll:
1. Capture, template, discard
The raw image is processed in-memory to extract a mathematical template, then discarded. The original image never touches disk and is never sent to a third party.
2. Encrypted at rest
Templates are stored encrypted using AES-256 with keys managed separately from the database. Even a full database dump does not reveal usable biometric data.
3. Scoped access
Each organization can only query its own templates. The org scope is derived from the verified API key — never from request parameters — so cross-tenant access is impossible.
4. Irreversible deletion
When you delete a template, it is permanently removed within 30 days. Backups containing the template age out on the same schedule. Deletion is verified in the audit log.
Why templates matter. A face template is a list of numbers that only means something to the matching algorithm. It cannot be reversed into a photo, and it cannot be used on another system. Even if our database leaked tomorrow, the leaked data would be useless.
Encryption
In transit
- TLS 1.2+ required for all API and web traffic. TLS 1.0 and 1.1 are disabled.
- HSTS enforced, preventing downgrade to plain HTTP.
- Certificate pinning available for Enterprise customers integrating mobile apps.
At rest
- Disk-level encryption on all database and backup storage.
- Field-level encryption for biometric templates with keys stored in a separate secret manager.
- HMAC-SHA256 for all API keys and invite tokens — the raw value is never stored.
- Argon2id for password hashing (memory-hard, resistant to GPU brute force).
Authentication & access control
- Passwordless options. Face login is available and eliminates credential stuffing entirely.
- Rate limiting. Login attempts are throttled per identifier and per IP. Failed attempts lock progressively — 5 failures → 15 min lock; 10 failures → 60 min lock.
- Session security. Cookies are
HttpOnly,SameSite=Lax, andSecurewhen served over HTTPS. - CSRF protection. All state-changing form submissions require a per-session token validated with constant-time comparison.
- API key scoping. Every key carries an explicit scope list (
verify,attendance,enroll). An endpoint checks the required scope before running. - Revocation. Keys can be revoked instantly from the dashboard. Revoked keys are rejected at lookup, not after authentication.
Liveness & anti-spoofing
Every verify request passes through server-side liveness detection, independent of any client-side hint. This means a tampered client cannot disable it.
- Depth cues — a flat photo lacks the micro-parallax and depth information of a real face.
- Motion consistency — video replay attempts fail because their motion signature differs from live capture.
- Texture analysis — printed photos, screens, and masks have distinct surface textures detectable at the pixel level.
When liveness fails, the API returns 422 liveness_failed with a reason code. We do not return a match result in this case, even if the face itself matches.
Never disable liveness in production. The API accepts "liveness": false for testing purposes only. If you disable it in production, you lose the primary defense against photo and video replay attacks.
Infrastructure
- Regional isolation. Data is stored in the region you select — US East, EU West, or Asia Pacific. Cross-region transfer happens only when explicitly configured.
- Network segmentation. Database and application servers live in private subnets. Only the API gateway is publicly reachable.
- Least privilege. Service accounts have the minimum permissions needed to function. No shared credentials across services.
- Secrets management. Environment secrets are never committed to source control and are rotated periodically.
- Backups. Encrypted daily backups, with a documented restore procedure tested at least quarterly.
Compliance & data protection
| Framework | Status | Notes |
|---|---|---|
| GDPR (EU) | Aligned | Data subject rights supported; DPAs available on request |
| PDPA (Singapore / Thailand) | Aligned | Consent-first design; explicit purpose limitation |
| CCPA / CPRA (California) | Aligned | No sale of personal information; right to delete honored |
| BIPA (Illinois) | Customer-managed | Requires written consent — template provided, enforcement is yours |
| SOC 2 Type II | In progress | Targeting report availability in 2027 |
| ISO 27001 | Planned | Roadmap pending SOC 2 completion |
We provide a Data Processing Agreement (DPA) for customers who need one to satisfy their own compliance obligations. Request it by emailing security@facelearn.io.
Consent & ethics
FaceLearn is a tool. How it's used is up to you — and how it's used ethically is up to you too.
We require our customers to:
- Obtain explicit, informed consent from every person whose face is enrolled
- Clearly disclose what the data will be used for
- Provide an easy way for individuals to withdraw consent and request deletion
- Comply with all applicable biometric privacy laws in their jurisdiction
We will not:
- Facilitate mass surveillance or tracking of individuals without consent
- Sell, license, or share biometric data with third parties for any purpose
- Allow the service to be used for law-enforcement identification without a lawful order
If you believe a FaceLearn-powered application is being used unethically, please report it to security@facelearn.io. We investigate every report.
Incident response
If a security incident occurs, we follow a documented response plan:
-
Detect & contain
Alerts from monitoring and audit logs trigger immediate investigation. If a live threat is identified, affected systems are isolated within minutes.
-
Assess scope
We determine what data was involved, which customers are affected, and whether the exposure is ongoing or historical.
-
Notify within 72 hours
If personal data is confirmed breached, we notify affected customers and relevant authorities within 72 hours of becoming aware, as required by GDPR and similar frameworks.
-
Remediate & disclose
We fix the underlying issue, rotate affected credentials, and publish a post-mortem for Enterprise customers. We do not bury incidents.
No security incident has occurred to date. This page describes our plan, not a history of events. If that ever changes, we will say so here.
Responsible disclosure
We welcome security research. If you find a vulnerability in FaceLearn.io, please report it to us privately before public disclosure.
Report a vulnerability
Email a detailed report to security@facelearn.io. Include:
- Steps to reproduce
- Impact assessment
- Any proof-of-concept code or screenshots
- Your preferred name and contact for credit (optional)
What we commit to:
- Acknowledge your report within 48 hours
- Provide an initial assessment within 5 business days
- Keep you updated until the issue is resolved
- Credit you publicly if you wish (unless you prefer anonymity)
- Not pursue legal action for good-faith research conducted within our scope
Out of scope: denial-of-service attacks, spam, social engineering against our team, and physical attacks against our infrastructure.
Security questions?
If you're an institution evaluating FaceLearn and need to complete a security questionnaire, request our standard response pack:
- Security whitepaper (PDF)
- Data Processing Agreement (DPA)
- Sub-processor list
- Penetration test summary (available under NDA for Enterprise)
Email security@facelearn.io and we'll respond within one business day.
Ready to get started securely?
Create a free account — no credit card, no raw images stored, full control over your data.
Start free