At Review Spaces, security and privacy are fundamental considerations in how we design, build, and operate our products.

We understand that creative professionals and organizations trust us with valuable intellectual property, project assets, prompts, and generated content. Our goal is to minimize risk through secure infrastructure, limited data collection, strong access controls, and industry-standard security practices.

While Review Spaces is not currently ISO 27001 certified, we follow security principles and operational controls commonly associated with modern SaaS platforms and continue to evaluate additional formal security and compliance measures as the platform grows.

01

Infrastructure & Platform Security

Review Spaces is hosted on professionally managed cloud infrastructure with security controls designed to protect customer data and platform availability.

  • Encrypted communication using TLS/HTTPS
  • Managed cloud infrastructure hosted in secure data centers
  • Automated database backups
  • Multi-factor authentication (MFA) and secure authentication controls
  • Limited production access restricted to authorized personnel only
  • Secure session management
  • Cross-Site Request Forgery (CSRF) protection
  • Security headers and browser hardening controls
  • Continuous monitoring and operational alerting
02

Access Controls

Production systems are accessible only to the Review Spaces founders and authorized administrators. Access is granted on a least-privilege basis and protected with strong authentication controls.

03

Data Protection

We intentionally collect and retain as little personal data as possible.

Information we store includes email address, full name, company or studio information where provided, computer name where provided, account preferences, prompts submitted through the platform, and usage and billing records required to operate the service.

We do not store credit card numbers, payment card details, banking information, government-issued identification documents, or unnecessary personal information.

All payment processing is handled directly by Stripe, a leading payment processor. Review Spaces does not receive or store customer payment card information.

04

Password & Authentication Security

User passwords are never stored in plain text.

Passwords are securely hashed using bcrypt with unique salting before being stored. This helps protect account credentials even in the unlikely event of unauthorized database access.

Two-factor authentication is available for Review Spaces accounts, alongside secure session management and controls for signing out other devices. Administrative access is protected with additional authentication controls.

Secrets, API credentials, and infrastructure configuration are stored separately from application source code.

05

Image & Content Retention

Review Spaces is designed around short-term processing rather than long-term storage.

Uploaded and generated image files are automatically removed after 24 hours.

This 24-hour period applies to image files. Account information, prompts, activity history, usage, billing, and operational records follow separate retention requirements described in the Privacy Policy.

06

Customer Ownership

Customers retain rights to their prompts, uploaded images, and other creative content they provide to Review Spaces.

Review Spaces does not claim ownership of customer-created content. Rights in AI-generated outputs may depend on applicable law and the terms of the relevant AI provider.

07

Third-Party Providers

To provide our services, Review Spaces works with trusted infrastructure and technology providers.

We carefully select providers with established security practices and enterprise-grade infrastructure.

  • DigitalOcean (cloud infrastructure)
  • Stripe (payment processing)
  • Google / Gemini (AI services)
  • OpenAI (AI services)
  • xAI / Grok (AI services)
  • ByteDance / Seedream (AI services)
  • Freepik / Magnific (image enhancement services)
  • Unsplash (visual reference services)
08

Privacy & GDPR

Review Spaces is committed to protecting customer privacy and complying with applicable data protection regulations.

For privacy-related requests, please contact [email protected].

Depending on applicable law, customers may:

  • Request deletion of their account
  • Request deletion of personal information
  • Ask questions about data processing
  • Exercise applicable privacy rights
09

Contact

For security issues, contact [email protected]. For support, contact [email protected].