Security
How your event’s memories are protected: access, encryption, and a tamper-evident record of what we do.
With our lawyers
This document is with our lawyers for final review. Still to be confirmed: the effective date.
The legal pages are published as one set, so every page carries this notice until the last detail is confirmed. Anything this page quotes that is still outstanding is marked below.
If you need any of it now, email hello@mosaikin.app and we will tell you.
Your event’s memories are irreplaceable. Here’s how we protect them.
1. Access
- Private by default. Events are invite-code gated; galleries are public only by the host’s explicit choice.
- Media is never served from raw storage links. Every photo passes through an access-controlled route that enforces the event’s privacy settings.
- Host sign-in is handled by a dedicated authentication provider (Supabase), with Google sign-in supported. We store no card details — payments are processed by Stripe (PCI DSS Level 1).
- Uploads are protected against automated abuse (Cloudflare Turnstile) and rate-limited.
2. Data protection
- Encryption in transit (TLS) and at rest on all storage.
- EXIF/GPS stripped from photos before any servable copy exists.
- Private by design: guests contribute without accounts, and we collect the minimum needed to run the service (see the Privacy Notice).
3. Integrity and accountability
- Administrative and safety actions are recorded in a tamper-evident, append-only audit log (hash-chained).
- The content safety pipeline fails closed: if scanning is unavailable, content is held for human review rather than published.
- Reports of content, and the decisions taken on them, are recorded on the same audit trail (see Safety).
4. Code and dependencies
Dependencies are locked and vulnerability-scanned on every change, and the codebase is gated by automated security linting and secret scanning before anything ships.
5. Reporting a vulnerability
If you find a security issue, tell us privately at safety@mosaikin.app — we’ll acknowledge promptly, keep you informed, and won’t take action against good-faith research that respects user privacy and doesn’t disrupt the service. Please don’t access data that isn’t yours or test against real events.