SECURITY
Security by architecture, not by promise.
Scanon.ai is built so that the safest thing we can do with your media is the only thing we do: process it in memory, return the redacted file, and forget it ever existed. Nothing is stored on disk, nothing is logged with your content, nothing is shared with third parties.
Data handling
- In-memory only. Uploaded media is processed in volatile memory and never written to persistent storage.
- Zero retention. Source files and processed output are wiped the moment the response is delivered to your browser or webhook.
- No training on user data. Your media is never used to train, fine-tune, or evaluate our models.
- EXIF stripping. Location, device, and timestamp metadata is removed from every processed file by default.
- No accounts required. The web tool issues a one-time secure ID and password — we don't collect names, emails, or identifiers to use it.
Transport & infrastructure
- TLS 1.3 for all traffic between your browser and our edge.
- HSTS enforced on all production domains.
- Isolated inference. All AI inference runs on infrastructure we control — no third-party model APIs ever see your media.
- Least-privilege access. Production systems are restricted to a minimal on-call group with audited access.
- Hardened images and automated dependency scanning on every deploy.
Application security
- Strict Content-Security-Policy and standard hardening headers.
- Server-side input validation and strict file-type checks before any model touches a byte.
- Rate limiting and abuse protection on all public endpoints.
- Continuous monitoring with anomaly alerts on the redaction pipeline.
Compliance posture
- GDPR data-minimization aligned — we don't ask for what we don't need, and we don't keep what we process. See our GDPR page for detail.
- CCPA aligned for users in California.
- HIPAA-friendly architecture. BAAs are available for qualifying API customers.
- SOC 2 Type II in progress.
Responsible disclosure
If you believe you've found a security issue in Scanon.ai, please email security@scanon.ai with steps to reproduce. We'll acknowledge within two business days and keep you updated through resolution. We do not pursue legal action against researchers acting in good faith under this policy: no privacy violations, no destruction of data, no degradation of service for other users, and no public disclosure before a fix ships.
Questions?
For procurement, security reviews, or a copy of our latest security overview, contact us or book a demo.