Security & Trust
Built for
brand-safe scale.
Generate thousands of on-model images with the controls a brand needs — clear data handling, honest compliance, responsible AI, and rights you actually own.
Trust, at a glance
- DPA available — Available
- Encryption in transit (HTTPS) — Available
- No training on your private uploads — Available
- SOC 2 — not in place; on our roadmap — On the roadmap
How we operate
Security by default.
The practices behind every image you generate.
- Data handling & retention
- Your uploads and generated images are yours — stored only to run the service.
- Delete assets anytime; deleted files are purged from primary storage promptly and from backups within 30 days.
- We never sell your data, and we don't use your private uploads to train models shared with other customers.
- Hosting & subprocessors
- Hosted on managed cloud infrastructure.
- Encrypted in transit (HTTPS/TLS).
- A short, vetted list of subprocessors — hosting, email, analytics, payments — documented in our DPA and kept current.
- Access & accounts
- Least-privilege internal access, scoped to what each role needs.
- Sensitive actions are logged for audit.
Responsible AI
Synthetic models. No deepfakes.
On-model imagery should be brand-safe by construction — not a liability waiting to surface.
- Our models are synthetic and AI-generated — not real identities scraped from the web.
- We don't build deepfakes, and we won't replicate a specific real person's likeness without documented consent and rights.
- Safety guardrails filter unsafe or infringing generations before they reach you.
- We honor takedown and appeal requests, and keep a human path open for edge cases.
Ownership
You own every image.
Full commercial usage rights on everything you generate — no model releases, no licensing, no royalties. Put it on your PDP, your ads and your lookbook, for as long as you like.
- No model releases
- No licensing
- No royalties
- Yours forever
Compliance
Where we are — honestly.
We'd rather tell you what's true today than claim a badge we haven't earned.
- Data Processing Agreement (DPA)
- Available now — Available
- Encryption in transit (HTTPS)
- Standard — Available
- SOC 2
- Not in place — on our roadmap — On the roadmap
- Independent penetration testing
- Not carried out yet — On the roadmap
SOC 2 is not in place; it is on our roadmap. No independent penetration test has been carried out yet. For our current subprocessor list, email contact@noshot.co.
Documents
Read the fine print.
The agreements and live status behind the product.
- Data Processing Agreement
- How we process personal data on your behalf, with our subprocessor list.Read the DPA
- Privacy Policy
- What we collect, why, and the choices you have.Read privacy
- Terms of Service
- The terms that govern your use of NoShot.Read terms
- System status
- How to reach us if something isn't working.View status
Talk to our team
about security.
Questions about data handling, our DPA or subprocessors — we'll walk you through it.