Security Overview

Hosting & Data Centers

• Platform infrastructure is hosted by Liquid Web, a SOC 2 and SOC 3 certified hosting provider with enterprise-grade data center facilities in the United States.
• Data centers feature physical access controls, biometric entry, 24/7 surveillance, redundant power, and environmental controls.
• Platform status is monitored and publicly available at status.triprism.com.

Cloud Storage

• Photographs and media assets are stored on Liquid Web S3-compatible object storage with server-side encryption at rest (AES-256).
• Access to stored files is controlled via time-limited signed URLs that expire after a configurable window (default: 24 hours).
• S3 bucket policies enforce least-privilege access: only the application service account has write access.

Network Security

• All data in transit is encrypted using TLS 1.2 or higher.
• HTTPS is enforced across all Platform domains with no fallback to unencrypted connections.
• Database connections are restricted to application servers only; no public database access is permitted.

Endpoint Protection

• All infrastructure endpoints are protected by enterprise-grade cybersecurity software with real-time threat detection, malware prevention, and automated remediation.
• Endpoint protection is centrally managed with continuous monitoring and alerting.

Authentication

• Passwords are stored using one-way cryptographic hashing; we never store plaintext passwords.
• Two-factor authentication (2FA) is available for all accounts via TOTP (authenticator app), email, or SMS verification.
• MFA is mandatory for TriPrism administrative access.
• Photographer account owners can enforce MFA for users in their own account from the account dashboard, based on their policy requirements.
• Configurable password expiry policies (30 to 365 days) with forced reset on next login.
• Per-username and per-IP rate limiting protects against brute force login attempts with automatic lockout after repeated failures.

Authorization

• Role-based access control (RBAC) with 10 distinct user roles, each with granular permission sets covering read, write, and execute tiers.
• Per-user permission overrides allow photographers to customize access beyond role defaults, including action-level sub-keys (create, delete, settings, graphics).
• Geographic scoping restricts data visibility for regional, area, and location-level users to their assigned organizational units.
• Session-based authentication with automatic expiry after 2 hours of inactivity.

Data Protection

• Cross-site request forgery (CSRF) protection on all form submissions.
• Input validation and output encoding to prevent injection attacks.
• Sensitive credentials (API keys, payment tokens) are encrypted at rest using application-level encryption.
• Database queries use parameterized statements to prevent SQL injection.

API Security

• Webhook endpoints (SendGrid, Twilio) verify cryptographic signatures to authenticate inbound requests.
• The API Integration Builder enforces SSRF protections: private IP ranges, internal hostnames, and metadata endpoints are blocked.
• Photographer-configured API integrations use encrypted credential storage and are validated at both save-time and runtime.

Audit Logging

• All administrative actions are recorded in an append-only audit log, including: who performed the action, what was changed, when, from where (IP address), and the outcome (success/failure).
• Risk-based classification automatically flags unusual activity patterns (e.g., high-volume deletions, off-hours access, privilege escalation) for immediate review.
• Per-photographer activity logs provide account-level audit trails accessible to photographer administrators.
• Audit logs are retained for a minimum of 7 years to support contractual, security, and regulatory obligations.

Monitoring & Alerting

• Automated alerts notify administrators of elevated and critical security events in real time.
• Login failure monitoring with configurable thresholds triggers alerts for potential brute force or credential stuffing attacks.
• 2FA failure monitoring detects and alerts on repeated authentication bypass attempts.

Access Management

• Employee access to production systems follows the principle of least privilege.
• Production access is held by a small, named group; background screening is required for anyone granted it.
• Administrative accounts are protected with mandatory two-factor authentication.
• Admin masquerade sessions (for support purposes) are logged with the original administrator’s identity preserved in the audit trail.
• Read-only admin roles are available for support staff who need to view but not modify photographer accounts.
• Workstations used for production access are password-protected and lock automatically after five minutes idle.

Personnel Security & Awareness

• Formal security training is delivered annually, with lighter quarterly reminders reinforcing phishing and social-engineering awareness.
• Training completion is tracked and retained.
• Incident-reporting expectations are documented in policy and communicated with the training.

Outbound Integration Control

• Where a client configures the platform to send data to a system of their own, the integration must be documented: what it sends, where, by what transport, and for what purpose.
• The receiving organization must return a signed attestation before data flows, confirming encryption at rest and in transit, restricted access, purpose limitation, secure deletion, and 72-hour breach notification to us.
• Attestations expire after 365 days. Reminders are issued as expiry approaches, and an integration whose attestation lapses is disabled automatically rather than continuing to send.
• The signed record snapshots the field mapping, purpose and masked endpoint as they stood at signing, so later drift is visible against what was agreed.

Continuous and Scheduled Scanning

• A security agent runs continuously on the hosting platform, providing real-time threat detection, malware prevention and automated remediation.
• A full automated vulnerability and malware scan of the server estate is performed daily.
• A PCI-standard external scan of the public perimeter is performed monthly.
• Platform dependencies are checked against a public vulnerability advisory database on every code change and on a scheduled weekly sweep, so an advisory published against a component that has not changed is still caught without waiting for the next release.
• Findings from every scanning source are triaged, prioritized and tracked to remediation and closure in our internal issue management system.

Penetration Testing

• Penetration testing is performed internally, on a recurring basis.
• The most recent test covered authentication and session handling, access control, tenant isolation, injection surfaces and public API endpoints.
• Testing runs against a full-stack environment with the alerting pipeline live, so the detection and alerting path is exercised by the test rather than assumed.
• Findings are ticketed, prioritized and tracked to closure through the same remediation workflow as scan findings.
• A further internal test is scheduled for mid-September 2026, ahead of the next platform release.
• Independent third-party penetration testing has not been performed to date. Where a client requires an independent test, that is a conversation we are open to having rather than a capability we currently claim.

Responsible Disclosure

• Externally reported vulnerabilities enter the same triage and remediation workflow. The reporting route and our handling commitments are set out in §9 below.

• GDPR Tools: Built-in data search, export (CSV ZIP), and cascade-safe erasure across all data channels, with typed confirmation and dry-run impact preview.
• Suppression Lists: Per-photographer email and SMS suppression lists automatically populated by bounce/complaint processing. Checked before every outbound communication.
• Model Release Management: Digital consent capture with configurable templates, customer-facing revocation links, and audit trail.
• Gallery Access Control: Per-location gallery enable/disable, email allowlists, and configurable gallery code types.
• No Biometric Processing: PhotoTouch does not perform facial recognition, biometric template generation, or cross-photo identity matching on any photographs.
• No Third-Party Tracking by PhotoTouch: We conduct no third-party tracking of our own. PhotoTouch operates no analytics property, advertising account or marketing pixel against customer traffic, sets no advertising or tracking cookies, and shares no data with advertising networks. No session-replay, heatmap or session-recording tooling runs on the platform or the storefronts, from any party.
• Client-Installed Tags: Photographers and partner organizations are given the opportunity to install their own tags on their own storefronts, and are the controller of any data those tags collect. Two paths exist and both are constrained. Marketing tags accept validated identifiers only (Google Analytics 4, Google Tag Manager, Meta pixel, Google Ads conversion), matched against an anchored pattern per vendor, so pasting a whole vendor snippet does not store or emit that snippet: only a recognized identifier is extracted from it and kept. Live chat is the one place tenant-supplied vendor script reaches a customer page, and it is restricted by a vendor host allow-list mirrored across the platform and both storefronts; a widget whose host is not on that list is not printed. The list names recognized chat providers only, and no session-recording or heatmap product appears on it. Both are off unless a client turns them on.
• Data Residency: Image storage and the application database are United States-based for all accounts and all regions; there is no in-region data store. Puerto Rico and Guam are United States territories, so hosting for those accounts is domestic rather than a cross-border transfer, though each has its own breach-notification requirements. Everywhere else this is a cross-border transfer, and the mechanism differs by regime: Australian Privacy Principle 8 for Australia; IPP 12 of the Privacy Act 2020 for New Zealand; the UK International Data Transfer Addendum under UK GDPR and the Data Protection Act 2018; the EU Standard Contractual Clauses for France and the wider EEA; Article 28 of the Act on the Protection of Personal Information for Japan; contractual comparable-protection measures under PIPEDA for Canada, with a privacy impact assessment where Quebec’s Law 25 applies; and the privacy notice plus contractual measures under the Federal Law on the Protection of Personal Data Held by Private Parties for Mexico. Overseas recipients are bound by contract to handle personal information consistently with the applicable principles. Text messaging to Australian and New Zealand numbers can be routed through an Australian carrier, at the client’s election. See the Privacy Policy, section 4.
• Return & Deletion at End of Term: Data runs the retention term the photographer has configured or agreed, and is then securely removed; ending the relationship neither shortens nor extends that clock. On termination of an account, data is retained for 90 days to allow reactivation, then permanently deleted from production systems, with backup copies purged on the same schedule. Audit logs, which may carry references to personal data, are retained for seven years to support contractual, security and regulatory requirements — the deliberate exception. Earlier deletion may be requested at any time. These are contractual obligations, set out at sections 10 and 12 of the Data Processing Agreement.

• Outbound emails are delivered via SendGrid with SPF, DKIM, and DMARC authentication to prevent spoofing and improve deliverability.
• Webhook signature verification ensures that delivery event data (opens, clicks, bounces) originates from legitimate sources.
• Bounce and complaint processing with automatic suppression prevents sending to invalid or complaining addresses.
• Configurable sending hours prevent outbound communications during off-hours, with timezone-aware scheduling.
• SMS delivery is tracked via Twilio webhooks with automatic suppression for undeliverable numbers and opt-outs.

Backup Infrastructure

• Automated database backups are performed on a regular schedule and stored in geographically separate off-site locations using enterprise backup infrastructure.
• Backup data is encrypted at rest and follows the same retention schedule as primary data, so a deletion in production is not undone by a restore.
• File-level and system-level backups are maintained independently of database backups to provide multiple recovery paths.

Recovery & Continuity

• Recovery procedures are tested periodically to verify that data can be restored within acceptable timeframes.
• Infrastructure is designed with redundancy at the network, compute, and storage layers to minimize the impact of hardware failures.
• Platform status and availability are monitored continuously with public reporting at status.triprism.com.

Periodic Reviews

• Scheduled compliance reviews are conducted at 30, 90, 180, and 365-day intervals covering audit log review, access verification, credential rotation, and integration audits.
• Each review produces a documented record of findings, action items, and the reviewer’s identity, forming an auditable evidence trail.
• Completing a review schedules the next one of that type automatically at its cadence, so the review calendar does not depend on anyone remembering to set it.
• A review not completed by its due date is marked overdue without manual intervention, and one more than seven days overdue is escalated by email to the security owner.

Compliance Frameworks

Third-party provider certifications are available through vendor trust portals. Platform assurance inquiries: security@triprism.com.

• Controls are implemented and operating against the SOC 2 Trust Services Criteria and mapped to ISO/IEC 27001:2022 Annex A. The mapping itself is set out in §7.2 below, control area by control area. Formal attestation and certification have not been obtained; we are in the evidence-collection stage of a SOC 2 readiness program, with continuous control monitoring in place
• Our incident response policy requires quarterly mock exercises and one annual live drill, and requires that drill records be retained
• Vulnerability scanning and penetration testing are set out in full in §3.1: a continuously running security agent, a daily automated scan of the server estate, a monthly PCI-standard external perimeter scan, dependency advisory checks on every code change and weekly, and recurring internal penetration testing. Findings from every source are tracked to remediation and closure
• Privileged actions are risk-classified as they are recorded, and both single high-risk actions and abnormal frequencies of lower-risk ones raise an immediate alert
• Independent third-party penetration testing has not been performed to date
• Access and audit-log reviews run on a fixed 30, 90, 180 and 365-day calendar (§3, Periodic Reviews). Completing a review schedules the next one automatically, so the calendar does not depend on anyone remembering to set it
• Our backup and recovery policy requires at least one documented restore test per year
• Cyber insurance is currently under evaluation

This is the mapping referred to above. It sets out, control area by control area, where our controls sit against the SOC 2 Trust Services Criteria and against ISO/IEC 27001:2022 Annex A, and whether the control is operating today. It describes our own controls against those frameworks. It is not an assessment by anyone else, and it is not a certification: no SOC 2 report and no ISO/IEC 27001 certificate has been obtained.

In place means the control is implemented and operating. Internal means the activity is performed, but by us rather than by an independent third party. Inherited means the control is operated by the hosting provider under its own certifications rather than by us. Not obtained means exactly that.

• We maintain a documented incident response plan covering identification, containment, eradication, recovery, and post-incident review.
• Security incidents affecting customer data are communicated to affected photographers without undue delay, including within 72 hours where required by applicable law (for example GDPR Article 33).
• Post-incident reviews are conducted to identify root causes and implement preventive measures.

If you discover a security vulnerability in the PhotoTouch platform, we encourage responsible disclosure. Please report vulnerabilities to:

Email

security@triprism.com

Please include a description of the vulnerability, steps to reproduce, and any supporting evidence. We will acknowledge receipt within 2 business days and work to address confirmed vulnerabilities promptly. We ask that you not publicly disclose the vulnerability until we have had a reasonable opportunity to address it.

For security inquiries, audit requests, or to report a concern:

Email

security@triprism.com

Company

TriPrism, Inc. dba PhotoTouch, Inc.

Address

San Diego, California, United States

Status Page

status.triprism.com