Security by architecture, not by promise.

Data handling

• No training on user data. Your media is never used to train, fine-tune, or evaluate our models.
• EXIF stripping. Location, device, and timestamp metadata is removed from every processed file by default.
• No accounts required. The web tool issues a one-time secure ID and password — we don't collect names, emails, or identifiers to use it.

Transport & infrastructure

• TLS 1.3 for all traffic between your browser and our edge.
• HSTS enforced on all production domains.
• Isolated inference. All AI inference runs on infrastructure we control — no third-party model APIs ever see your media.
• Least-privilege access. Production systems are restricted to a minimal on-call group.
• Hardened images and automated dependency scanning on every deploy.

Application security

• Strict Content-Security-Policy and standard hardening headers.
• Server-side input validation and strict file-type checks before any model touches a byte.
• Rate limiting and abuse protection on all public endpoints.
• Continuous monitoring with anomaly alerts on the redaction pipeline.

Compliance posture

• GDPR data-minimization aligned — we don't ask for what we don't need, and we don't keep what we process. See our GDPR page for detail.
• CCPA aligned for users in California.
• SOC 2 Type II in progress.

Responsible disclosure

If you believe you've found a security issue in Scanon.ai, please email security@scanon.ai with steps to reproduce. We'll acknowledge within two business days and keep you updated through resolution. We do not pursue legal action against researchers acting in good faith under this policy: no privacy violations, no destruction of data, no degradation of service for other users, and no public disclosure before a fix ships.

Questions?

For procurement, security reviews, or a copy of our latest security overview, contact us or book a demo.